Analysis
-
max time kernel
39s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 15:59
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA DE ENVÍO.pdf.exe
Resource
win7v20201028
General
-
Target
FACTURA DE ENVÍO.pdf.exe
-
Size
1.0MB
-
MD5
f2bdb4e0ad5f59e25ae0aa08cd262565
-
SHA1
6f58e9f29a662c028e2375e69ff25d53397596c1
-
SHA256
05a2e1c109cbf757af3856c7080abe847c40f17b56a2a0476efff9a82b25face
-
SHA512
fc5a1fcee82f470ed61dfa378a89288276787379358f047d64949f6bbfa3d706d456702be61c24f2d189de7839372f7eebd21b8364bff718872694e3b06f061a
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/HsSpKI8PLZu2g
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exedescription pid process target process PID 1036 set thread context of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exepid process 1036 FACTURA DE ENVÍO.pdf.exe 1036 FACTURA DE ENVÍO.pdf.exe 1036 FACTURA DE ENVÍO.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exepid process 2240 FACTURA DE ENVÍO.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exeFACTURA DE ENVÍO.pdf.exedescription pid process Token: SeDebugPrivilege 1036 FACTURA DE ENVÍO.pdf.exe Token: SeDebugPrivilege 2240 FACTURA DE ENVÍO.pdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
FACTURA DE ENVÍO.pdf.exedescription pid process target process PID 1036 wrote to memory of 3508 1036 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1036 wrote to memory of 3508 1036 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1036 wrote to memory of 3508 1036 FACTURA DE ENVÍO.pdf.exe schtasks.exe PID 1036 wrote to memory of 3548 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 3548 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 3548 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe PID 1036 wrote to memory of 2240 1036 FACTURA DE ENVÍO.pdf.exe FACTURA DE ENVÍO.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZQenHDecxguOQP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6C0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\FACTURA DE ENVÍO.pdf.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC6C0.tmpMD5
6575a0bd7fdabda49c60517fe9d87035
SHA1184856c5f03ba8f98c2d11ddef15a96c5d0cb1d2
SHA25694a49f0e96a5bd52e0b1a7d3695daaf39593dc974796be1515c5f7f6337af151
SHA5127c06061a0a5dfb97031c2ddfa5141f01828bb88c5350b814864ca0a464e09e42b5f113552212956e6396759daf56bd4467c797e161c765634755ac2ebc619587
-
memory/1036-6-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/1036-5-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1036-2-0x0000000073EE0000-0x00000000745CE000-memory.dmpFilesize
6.9MB
-
memory/1036-7-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/1036-8-0x0000000005380000-0x000000000538E000-memory.dmpFilesize
56KB
-
memory/1036-9-0x0000000005E50000-0x0000000005E88000-memory.dmpFilesize
224KB
-
memory/1036-10-0x0000000005F30000-0x0000000005F31000-memory.dmpFilesize
4KB
-
memory/1036-3-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/2240-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2240-14-0x00000000004139DE-mapping.dmp
-
memory/2240-15-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3508-11-0x0000000000000000-mapping.dmp