Analysis
-
max time kernel
51s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 18:04
Static task
static1
Behavioral task
behavioral1
Sample
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
Resource
win7v20201028
General
-
Target
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
-
Size
862KB
-
MD5
d9f053e22a958a4a680bb3793aeedc45
-
SHA1
7a534201eec5c748471411c159fbabd5696be470
-
SHA256
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3
-
SHA512
07b999319bbc2fab211cc85b9ec0b56d71224152564d338ba0fb6b2ba81336c8409fcec0f97b22182c54d2d4eec672cf8271a68ddd3b4f4874c76192cbb5e434
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/cfOoZYb0LXPms
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process target process PID 3992 set thread context of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exepid process 1280 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process Token: SeDebugPrivilege 1280 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exedescription pid process target process PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe PID 3992 wrote to memory of 1280 3992 aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aaf7cb6e80034a3fcf68ea50696962f7b5837bea089f9193070165f6a3f602c3.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1280-12-0x00000000004139DE-mapping.dmp
-
memory/1280-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3992-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3992-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/3992-5-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/3992-6-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3992-7-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/3992-8-0x0000000005510000-0x000000000551E000-memory.dmpFilesize
56KB
-
memory/3992-9-0x00000000060F0000-0x0000000006128000-memory.dmpFilesize
224KB
-
memory/3992-10-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB