Analysis
-
max time kernel
15s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 12:06
Static task
static1
Behavioral task
behavioral1
Sample
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
Resource
win7v20210408
General
-
Target
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
-
Size
379KB
-
MD5
17ee7ef4673eab6d45037b04cf2c70b3
-
SHA1
eab393fa429087dff64a209d5afdfedeb929e5eb
-
SHA256
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe
-
SHA512
92be0fd0bcdfedd24f2476fb32406b9570a5603f7bcae9dcb6ecfb954b0d121852b7913ffdca682af80c6430893bd0b163a64376ee1c19f20da3bab558ac8ac2
Malware Config
Extracted
lokibot
http://exinmbakala.xyz/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process target process PID 4024 set thread context of 1172 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exepid process 1172 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process Token: SeDebugPrivilege 1172 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exedescription pid process target process PID 4024 wrote to memory of 1172 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 4024 wrote to memory of 1172 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 4024 wrote to memory of 1172 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe PID 4024 wrote to memory of 1172 4024 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe 989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"C:\Users\Admin\AppData\Local\Temp\989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx1AC2.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
\Users\Admin\AppData\Local\Temp\nsx1AC2.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
memory/1172-116-0x00000000004139DE-mapping.dmp
-
memory/1172-117-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB