Analysis
-
max time kernel
41s -
max time network
38s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:59
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA DE ENVÍO.pdf.exe
Resource
win7v20201028
General
-
Target
FACTURA DE ENVÍO.pdf.exe
-
Size
1.0MB
-
MD5
f2bdb4e0ad5f59e25ae0aa08cd262565
-
SHA1
6f58e9f29a662c028e2375e69ff25d53397596c1
-
SHA256
05a2e1c109cbf757af3856c7080abe847c40f17b56a2a0476efff9a82b25face
-
SHA512
fc5a1fcee82f470ed61dfa378a89288276787379358f047d64949f6bbfa3d706d456702be61c24f2d189de7839372f7eebd21b8364bff718872694e3b06f061a
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/HsSpKI8PLZu2g
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exedescription pid process target process PID 1936 set thread context of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exepid process 1844 FACTURA DE ENVÍO.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exedescription pid process Token: SeDebugPrivilege 1844 FACTURA DE ENVÍO.pdf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exedescription pid process target process PID 1936 wrote to memory of 684 1936 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1936 wrote to memory of 684 1936 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1936 wrote to memory of 684 1936 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1936 wrote to memory of 684 1936 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1936 wrote to memory of 1844 1936 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZQenHDecxguOQP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AE1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8AE1.tmpMD5
3ff52066e512f1d9ddc3635e1601a6e5
SHA1b07b2dd5342858d3078d2d8e14dcd9443b54df7d
SHA25682c9c6548224020614992396dbcac3aa0dd2aef1393adbcd0d6f411630b16574
SHA512ec602e1dad3a69cde5ec9f77fb036e12df38060878dd5db4102c7bee6f0d73b78d235cbf9063bbd2a3ec45c920264f09857fe87e0580bf29254e79124b5f423e
-
memory/684-7-0x0000000000000000-mapping.dmp
-
memory/768-12-0x000007FEF5BC0000-0x000007FEF5E3A000-memory.dmpFilesize
2.5MB
-
memory/1844-10-0x00000000004139DE-mapping.dmp
-
memory/1844-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1844-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1936-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1936-3-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/1936-5-0x00000000006B0000-0x00000000006BE000-memory.dmpFilesize
56KB
-
memory/1936-6-0x0000000000F60000-0x0000000000F98000-memory.dmpFilesize
224KB