Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-01-2021 10:14
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe
-
Size
881KB
-
MD5
209a9397bb6c68626ff785164388a65d
-
SHA1
a3d1b6a707b971638ff56f7470daecdf7b93a346
-
SHA256
fa27c16596dc5c39fafe2a14e459db8ae0bae2be3d5222d6df7331215c04efaf
-
SHA512
2186aa67a1eb8a295622b8aaa00938bba387304f8662dd91a1c0d6c2b738fb6533b4613d461b1e0bab2b63375c7739dc8439338339c6f89c7ff07a1667b87aa6
Malware Config
Extracted
lokibot
http://zunlen.com/chief/jojo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exedescription pid process target process PID 4000 set thread context of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exepid process 1096 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exedescription pid process Token: SeDebugPrivilege 1096 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exedescription pid process target process PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe PID 4000 wrote to memory of 1096 4000 SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42809.8376.6237.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-14-0x00000000004139DE-mapping.dmp
-
memory/1096-15-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1096-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4000-10-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/4000-7-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/4000-8-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/4000-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/4000-9-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/4000-11-0x0000000005770000-0x0000000005793000-memory.dmpFilesize
140KB
-
memory/4000-12-0x0000000006290000-0x00000000062E9000-memory.dmpFilesize
356KB
-
memory/4000-6-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/4000-5-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/4000-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB