Analysis
-
max time kernel
6s -
max time network
40s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 00:32
Static task
static1
Behavioral task
behavioral1
Sample
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe
Resource
win7v20210410
General
-
Target
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe
-
Size
379KB
-
MD5
17ee7ef4673eab6d45037b04cf2c70b3
-
SHA1
eab393fa429087dff64a209d5afdfedeb929e5eb
-
SHA256
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe
-
SHA512
92be0fd0bcdfedd24f2476fb32406b9570a5603f7bcae9dcb6ecfb954b0d121852b7913ffdca682af80c6430893bd0b163a64376ee1c19f20da3bab558ac8ac2
Malware Config
Extracted
lokibot
http://exinmbakala.xyz/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exepid process 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exedescription pid process target process PID 1036 set thread context of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exepid process 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exepid process 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exepid process 1356 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exedescription pid process Token: SeDebugPrivilege 1356 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exedescription pid process target process PID 1036 wrote to memory of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe PID 1036 wrote to memory of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe PID 1036 wrote to memory of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe PID 1036 wrote to memory of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe PID 1036 wrote to memory of 1356 1036 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe 989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe"C:\Users\Admin\AppData\Local\Temp\989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe"C:\Users\Admin\AppData\Local\Temp\989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nss8769.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
\Users\Admin\AppData\Local\Temp\nss8769.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
memory/1036-59-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1356-62-0x00000000004139DE-mapping.dmp
-
memory/1356-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB