Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 13:53
Static task
static1
Behavioral task
behavioral1
Sample
9449aee879faa4cb6ffbbfdcf01d2172.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
9449aee879faa4cb6ffbbfdcf01d2172.exe
-
Size
850KB
-
MD5
9449aee879faa4cb6ffbbfdcf01d2172
-
SHA1
7c14bea17348f92b578c145dddfa625b540938da
-
SHA256
bb43a9fe09eb4d8f88b60ae3a5dd7e46ab6cb46a241da67d632e7e84efdc7e8d
-
SHA512
3de5167f72683735df6fbcc61a7b536104c12b84f393cb57a2f26191ec94d99ad733eb1c3b1ea99889507391509dbc057e165c19fbe4c54152000009f36b850c
Malware Config
Extracted
Family
lokibot
C2
http://amrp.tw/ozi/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9449aee879faa4cb6ffbbfdcf01d2172.exedescription pid process target process PID 772 set thread context of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9449aee879faa4cb6ffbbfdcf01d2172.exepid process 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 772 9449aee879faa4cb6ffbbfdcf01d2172.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
9449aee879faa4cb6ffbbfdcf01d2172.exepid process 268 9449aee879faa4cb6ffbbfdcf01d2172.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9449aee879faa4cb6ffbbfdcf01d2172.exe9449aee879faa4cb6ffbbfdcf01d2172.exedescription pid process Token: SeDebugPrivilege 772 9449aee879faa4cb6ffbbfdcf01d2172.exe Token: SeDebugPrivilege 268 9449aee879faa4cb6ffbbfdcf01d2172.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9449aee879faa4cb6ffbbfdcf01d2172.exedescription pid process target process PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe PID 772 wrote to memory of 268 772 9449aee879faa4cb6ffbbfdcf01d2172.exe 9449aee879faa4cb6ffbbfdcf01d2172.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9449aee879faa4cb6ffbbfdcf01d2172.exe"C:\Users\Admin\AppData\Local\Temp\9449aee879faa4cb6ffbbfdcf01d2172.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9449aee879faa4cb6ffbbfdcf01d2172.exe"C:\Users\Admin\AppData\Local\Temp\9449aee879faa4cb6ffbbfdcf01d2172.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/268-66-0x00000000004139DE-mapping.dmp
-
memory/268-67-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/268-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/772-59-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/772-61-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/772-62-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/772-63-0x0000000004860000-0x00000000048D5000-memory.dmpFilesize
468KB
-
memory/772-64-0x0000000004420000-0x0000000004452000-memory.dmpFilesize
200KB