Analysis
-
max time kernel
8s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:06
Static task
static1
Behavioral task
behavioral1
Sample
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
Resource
win7v20210408
General
-
Target
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
-
Size
379KB
-
MD5
17ee7ef4673eab6d45037b04cf2c70b3
-
SHA1
eab393fa429087dff64a209d5afdfedeb929e5eb
-
SHA256
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe
-
SHA512
92be0fd0bcdfedd24f2476fb32406b9570a5603f7bcae9dcb6ecfb954b0d121852b7913ffdca682af80c6430893bd0b163a64376ee1c19f20da3bab558ac8ac2
Malware Config
Extracted
lokibot
http://exinmbakala.xyz/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process target process PID 360 set thread context of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 1556 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process Token: SeDebugPrivilege 1556 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process target process PID 360 wrote to memory of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 360 wrote to memory of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 360 wrote to memory of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 360 wrote to memory of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 360 wrote to memory of 1556 360 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsn4E9E.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
\Users\Admin\AppData\Local\Temp\nsn4E9E.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
memory/360-60-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1556-63-0x00000000004139DE-mapping.dmp
-
memory/1556-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB