Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 06:08
Static task
static1
Behavioral task
behavioral1
Sample
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe
Resource
win7v20210410
General
-
Target
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe
-
Size
427KB
-
MD5
d3e359abdef108edbabf23b3c44a13b3
-
SHA1
c0bd95902a800bae5f8625f7216860612a6db558
-
SHA256
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc
-
SHA512
2246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c
Malware Config
Extracted
lokibot
http://104.168.175.179/ghost1/panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
RFQ.exeRFQ.exepid process 3648 RFQ.exe 1964 RFQ.exe -
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/860-121-0x0000000005A40000-0x0000000005A61000-memory.dmp agile_net behavioral2/memory/860-125-0x0000000005570000-0x0000000005A6E000-memory.dmp agile_net behavioral2/memory/3648-136-0x0000000004900000-0x0000000004DFE000-memory.dmp agile_net behavioral2/memory/3648-140-0x0000000004900000-0x0000000004DFE000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ = "C:\\Users\\Admin\\AppData\\Roaming\\RFQ.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.exedescription pid process target process PID 3648 set thread context of 1964 3648 RFQ.exe RFQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exeRFQ.exepid process 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe 3648 RFQ.exe 3648 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exeRFQ.exeRFQ.exedescription pid process Token: SeDebugPrivilege 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe Token: SeDebugPrivilege 3648 RFQ.exe Token: SeDebugPrivilege 1964 RFQ.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.execmd.exeRFQ.exedescription pid process target process PID 860 wrote to memory of 1324 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe cmd.exe PID 860 wrote to memory of 1324 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe cmd.exe PID 860 wrote to memory of 1324 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe cmd.exe PID 1324 wrote to memory of 3884 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3884 1324 cmd.exe reg.exe PID 1324 wrote to memory of 3884 1324 cmd.exe reg.exe PID 860 wrote to memory of 3648 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe RFQ.exe PID 860 wrote to memory of 3648 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe RFQ.exe PID 860 wrote to memory of 3648 860 9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe PID 3648 wrote to memory of 1964 3648 RFQ.exe RFQ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe"C:\Users\Admin\AppData\Local\Temp\9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RFQ" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RFQ.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RFQ" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RFQ.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\RFQ.exe"C:\Users\Admin\AppData\Roaming\RFQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RFQ.exe"C:\Users\Admin\AppData\Roaming\RFQ.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\RFQ.exeMD5
d3e359abdef108edbabf23b3c44a13b3
SHA1c0bd95902a800bae5f8625f7216860612a6db558
SHA2569ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc
SHA5122246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c
-
C:\Users\Admin\AppData\Roaming\RFQ.exeMD5
d3e359abdef108edbabf23b3c44a13b3
SHA1c0bd95902a800bae5f8625f7216860612a6db558
SHA2569ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc
SHA5122246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c
-
C:\Users\Admin\AppData\Roaming\RFQ.exeMD5
d3e359abdef108edbabf23b3c44a13b3
SHA1c0bd95902a800bae5f8625f7216860612a6db558
SHA2569ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc
SHA5122246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c
-
memory/860-119-0x0000000005570000-0x0000000005A6E000-memory.dmpFilesize
5.0MB
-
memory/860-121-0x0000000005A40000-0x0000000005A61000-memory.dmpFilesize
132KB
-
memory/860-122-0x0000000006BD0000-0x0000000006BD1000-memory.dmpFilesize
4KB
-
memory/860-123-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/860-125-0x0000000005570000-0x0000000005A6E000-memory.dmpFilesize
5.0MB
-
memory/860-118-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/860-117-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/860-116-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/860-114-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/1324-124-0x0000000000000000-mapping.dmp
-
memory/1964-143-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1964-146-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1964-144-0x00000000004139DE-mapping.dmp
-
memory/3648-140-0x0000000004900000-0x0000000004DFE000-memory.dmpFilesize
5.0MB
-
memory/3648-142-0x0000000008980000-0x0000000008981000-memory.dmpFilesize
4KB
-
memory/3648-141-0x00000000063E0000-0x00000000063EB000-memory.dmpFilesize
44KB
-
memory/3648-136-0x0000000004900000-0x0000000004DFE000-memory.dmpFilesize
5.0MB
-
memory/3648-127-0x0000000000000000-mapping.dmp
-
memory/3884-126-0x0000000000000000-mapping.dmp