Analysis
-
max time kernel
66s -
max time network
111s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-06-2021 13:15
Static task
static1
Behavioral task
behavioral1
Sample
RvpOjGNoeUrU5YI.exe
Resource
win7v20210410
General
-
Target
RvpOjGNoeUrU5YI.exe
-
Size
1.1MB
-
MD5
40898897810b8ed4004003c936ac40ee
-
SHA1
f7ce06775d627c33e53d2fe49b0dc61dc6e2f8b6
-
SHA256
146895757ccfcc5080a9b371aade4468d1fc0c85accb4d907f6be49927c6d2c3
-
SHA512
fd8bb723ff16c45ebe70ff2f36fc7ea5818e44f8eb02cb114f3e24a6f714ac23e050eee060f809ae5f316cd568e6e3c551fe89aa304a3f0380b58be49c180666
Malware Config
Extracted
lokibot
http://63.141.228.141/32.php/3LJAZguIGMmJV
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
RvpOjGNoeUrU5YI.exedescription pid process target process PID 1932 set thread context of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RvpOjGNoeUrU5YI.exepid process 1932 RvpOjGNoeUrU5YI.exe 1932 RvpOjGNoeUrU5YI.exe 1932 RvpOjGNoeUrU5YI.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
RvpOjGNoeUrU5YI.exepid process 1488 RvpOjGNoeUrU5YI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RvpOjGNoeUrU5YI.exeRvpOjGNoeUrU5YI.exedescription pid process Token: SeDebugPrivilege 1932 RvpOjGNoeUrU5YI.exe Token: SeDebugPrivilege 1488 RvpOjGNoeUrU5YI.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RvpOjGNoeUrU5YI.exedescription pid process target process PID 1932 wrote to memory of 764 1932 RvpOjGNoeUrU5YI.exe schtasks.exe PID 1932 wrote to memory of 764 1932 RvpOjGNoeUrU5YI.exe schtasks.exe PID 1932 wrote to memory of 764 1932 RvpOjGNoeUrU5YI.exe schtasks.exe PID 1932 wrote to memory of 764 1932 RvpOjGNoeUrU5YI.exe schtasks.exe PID 1932 wrote to memory of 1036 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1036 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1036 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1036 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe PID 1932 wrote to memory of 1488 1932 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SefcAaptyL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D68.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9D68.tmpMD5
f696b95fcd1f1fbd03217824e02e9d91
SHA1217e1cc41a3fcd9bcdd05723adeb894f9f23c8dd
SHA256fd50d682d408da9f1c0b16c1b47e70b4c485ee1e3ec85d1af75bf2fddd9516bb
SHA512cdbc2e9509c94afa0f19e6d4edd65896aacfcca2e3cd938ac76aa12fa75a0b79939a6bc2a5356d6e0af4b3e60bebadf0a1f5236ed2f74fcd5beb08d0b591adbd
-
memory/764-65-0x0000000000000000-mapping.dmp
-
memory/1488-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1488-68-0x00000000004139DE-mapping.dmp
-
memory/1488-69-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1488-70-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1932-59-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1932-61-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/1932-62-0x0000000000440000-0x0000000000450000-memory.dmpFilesize
64KB
-
memory/1932-63-0x0000000004B70000-0x0000000004BD8000-memory.dmpFilesize
416KB
-
memory/1932-64-0x0000000004430000-0x0000000004460000-memory.dmpFilesize
192KB