Analysis
- max time kernel
137s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
01/04/2021, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
7876278346D754782.pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 7876278346D754782.pdf.exe
- Size 49KB
- Sample210401-9986e3nmpa
- SHA256 b64422c4e30cfeaa48bcd34feff0a7b56125307f0dad0447dfae34d3743f3bb8
- MD5 df6e26224f6a397fb74472d912cc82eb
- SHA1 6280eaf15acc77463df56f1c6fc3f0618dda6a80
- SHA512 c994e0b6f3d8b9e50d2a0014adbf74029cd3ed5a203af9e9abe7ada09f64b210558f3ca6c5db897795ecb9348d38361ee58ae6fe9fe239a7b17c7cd0a4a9ad8d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://athansie.com/chief/meks/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4648 set thread context of 4176 4648 7876278346D754782.pdf.exe 80 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3308 4648 WerFault.exe 22 - Delays execution with timeout.exe 1 IoCs
pid Process 788 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 7876278346D754782.pdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 7876278346D754782.pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 7876278346D754782.pdf.exe - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 4648 7876278346D754782.pdf.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4176 7876278346D754782.pdf.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4648 7876278346D754782.pdf.exe Token: SeRestorePrivilege 3308 WerFault.exe Token: SeBackupPrivilege 3308 WerFault.exe Token: SeDebugPrivilege 3308 WerFault.exe Token: SeDebugPrivilege 4176 7876278346D754782.pdf.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4648 wrote to memory of 3100 4648 7876278346D754782.pdf.exe 75 PID 4648 wrote to memory of 3100 4648 7876278346D754782.pdf.exe 75 PID 4648 wrote to memory of 3100 4648 7876278346D754782.pdf.exe 75 PID 3100 wrote to memory of 788 3100 cmd.exe 77 PID 3100 wrote to memory of 788 3100 cmd.exe 77 PID 3100 wrote to memory of 788 3100 cmd.exe 77 PID 4648 wrote to memory of 4188 4648 7876278346D754782.pdf.exe 78 PID 4648 wrote to memory of 4188 4648 7876278346D754782.pdf.exe 78 PID 4648 wrote to memory of 4188 4648 7876278346D754782.pdf.exe 78 PID 4648 wrote to memory of 4204 4648 7876278346D754782.pdf.exe 79 PID 4648 wrote to memory of 4204 4648 7876278346D754782.pdf.exe 79 PID 4648 wrote to memory of 4204 4648 7876278346D754782.pdf.exe 79 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80 PID 4648 wrote to memory of 4176 4648 7876278346D754782.pdf.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:788
-
-
-
C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"2⤵PID:4188
-
-
C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"2⤵PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"C:\Users\Admin\AppData\Local\Temp\7876278346D754782.pdf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 25082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308
-