Analysis
-
max time kernel
61s -
max time network
59s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 18:04
Static task
static1
Behavioral task
behavioral1
Sample
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
Resource
win7v20201028
General
-
Target
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
-
Size
862KB
-
MD5
d9f053e22a958a4a680bb3793aeedc45
-
SHA1
7a534201eec5c748471411c159fbabd5696be470
-
SHA256
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3
-
SHA512
07b999319bbc2fab211cc85b9ec0b56d71224152564d338ba0fb6b2ba81336c8409fcec0f97b22182c54d2d4eec672cf8271a68ddd3b4f4874c76192cbb5e434
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/cfOoZYb0LXPms
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process target process PID 1472 set thread context of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exepid process 1672 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process Token: SeDebugPrivilege 1672 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process target process PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 1472 wrote to memory of 1672 1472 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-10-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmpFilesize
2.5MB
-
memory/1472-2-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1472-3-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/1472-5-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/1472-6-0x0000000000610000-0x0000000000648000-memory.dmpFilesize
224KB
-
memory/1672-7-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1672-8-0x00000000004139DE-mapping.dmp
-
memory/1672-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB