Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-06-2021 11:44
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.img .exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
Shipping Documents.img .exe
-
Size
679KB
-
MD5
7d9fce60f332861fcd2260803f10e0eb
-
SHA1
5c011889f04c46a7e49c740c959efd1d722d65d6
-
SHA256
d8073b80ab8800400dd1a78ebe8cf04e87ca119e0aff49307956fe3cf13bd772
-
SHA512
e2bda565f202badf3a82be01101d63066fa736e40703dfd8df593c18279963dd8e4075654c5e904867bf74a908a5accf4ad3e2d3b5edb509aa88343905952d14
Malware Config
Extracted
Family
lokibot
C2
http://63.141.228.141/32.php/5mGrB9x77E21g
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Shipping Documents.img .exedescription pid process target process PID 1040 set thread context of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Shipping Documents.img .exepid process 1352 Shipping Documents.img .exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Shipping Documents.img .exedescription pid process Token: SeDebugPrivilege 1352 Shipping Documents.img .exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Shipping Documents.img .exedescription pid process target process PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe PID 1040 wrote to memory of 1352 1040 Shipping Documents.img .exe Shipping Documents.img .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.img .exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.img .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.img .exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.img .exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-59-0x00000000011C0000-0x00000000011C1000-memory.dmpFilesize
4KB
-
memory/1040-61-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/1040-62-0x0000000000450000-0x0000000000460000-memory.dmpFilesize
64KB
-
memory/1040-63-0x0000000005560000-0x00000000055E0000-memory.dmpFilesize
512KB
-
memory/1040-64-0x00000000055E0000-0x000000000562D000-memory.dmpFilesize
308KB
-
memory/1352-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1352-66-0x00000000004139DE-mapping.dmp
-
memory/1352-67-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/1352-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB