Analysis
-
max time kernel
118s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:34
Static task
static1
Behavioral task
behavioral1
Sample
contract YF8536851-1.exe
Resource
win7v20210408
General
-
Target
contract YF8536851-1.exe
-
Size
628KB
-
MD5
a43a5c69b4fc6c45bbf4c75ee8b3869b
-
SHA1
6d6dd739f8b5c24fc98930dc59809893dcd64070
-
SHA256
235413e22a54a09ad31fae8f8a22a0cf4a443115cbb5dd9fe85a9a563ac1ebc3
-
SHA512
c012f843c33a8240d8e9c6ba9a2e2aaa173c4a856e0ff72b5c219a5d11b90eb9e6f6883e9d53b74b8bdc9c7419bd8be380d962458a84bd8aab90d4d04a449e5f
Malware Config
Extracted
lokibot
http://abixmaly.duckdns.org/binge/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
contract YF8536851-1.exedescription pid process target process PID 2020 set thread context of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
contract YF8536851-1.exepid process 2020 contract YF8536851-1.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
contract YF8536851-1.exepid process 1632 contract YF8536851-1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
contract YF8536851-1.execontract YF8536851-1.exedescription pid process Token: SeDebugPrivilege 2020 contract YF8536851-1.exe Token: SeDebugPrivilege 1632 contract YF8536851-1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
contract YF8536851-1.exedescription pid process target process PID 2020 wrote to memory of 268 2020 contract YF8536851-1.exe schtasks.exe PID 2020 wrote to memory of 268 2020 contract YF8536851-1.exe schtasks.exe PID 2020 wrote to memory of 268 2020 contract YF8536851-1.exe schtasks.exe PID 2020 wrote to memory of 268 2020 contract YF8536851-1.exe schtasks.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe PID 2020 wrote to memory of 1632 2020 contract YF8536851-1.exe contract YF8536851-1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\contract YF8536851-1.exe"C:\Users\Admin\AppData\Local\Temp\contract YF8536851-1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AuWPVguZo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC68A.tmp"2⤵
- Creates scheduled task(s)
PID:268 -
C:\Users\Admin\AppData\Local\Temp\contract YF8536851-1.exe"C:\Users\Admin\AppData\Local\Temp\contract YF8536851-1.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC68A.tmpMD5
6d3576df001038867df38dd710cde938
SHA18420f7b69523ca14d9725e6ca7d9a6c33d02ad70
SHA2568e10313860700158e30dead07581cbf8ecfe50e74fe58192c8282486f6700ac7
SHA512fce7d4e9774f01a9ea4493bbeb09f28d996e0af63b0dfa4255fb9f821fa31e42ec9806404b12e714bf4cda4f19c13b000ff10c5a0d4a7f19a7b21b95350a45cb
-
memory/268-66-0x0000000000000000-mapping.dmp
-
memory/1632-69-0x00000000004139DE-mapping.dmp
-
memory/1632-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1632-70-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1632-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2020-60-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/2020-62-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2020-63-0x00000000008C0000-0x00000000008DB000-memory.dmpFilesize
108KB
-
memory/2020-64-0x0000000005E30000-0x0000000005E95000-memory.dmpFilesize
404KB
-
memory/2020-65-0x0000000001DD0000-0x0000000001DF0000-memory.dmpFilesize
128KB