Analysis
-
max time kernel
55s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 09:51
Static task
static1
Behavioral task
behavioral1
Sample
AVH3viH4ec3ZkIM.exe
Resource
win7v20210408
General
-
Target
AVH3viH4ec3ZkIM.exe
-
Size
574KB
-
MD5
fbce581748b0bc085cf3742c7f4e5859
-
SHA1
a624dd7766eab090e47ae0d97de8d7ef2dd0440c
-
SHA256
c9f200f2d880906c47c6a9c36a16b7a42851e62b27d531f7066651b6932a7aa6
-
SHA512
912ba02f3ddc00c82d1bf495dac086cc3d5d67c27aa184045131b32c1f832bd1bab3854845858e16c11f8f1b09b11e2c43cc5ea59b3750203aab11c3bae01a2a
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/4VhkXKQmUI30m
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/996-121-0x0000000001770000-0x000000000177B000-memory.dmp CustAttr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AVH3viH4ec3ZkIM.exedescription pid process target process PID 996 set thread context of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AVH3viH4ec3ZkIM.exepid process 996 AVH3viH4ec3ZkIM.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
AVH3viH4ec3ZkIM.exepid process 2140 AVH3viH4ec3ZkIM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AVH3viH4ec3ZkIM.exeAVH3viH4ec3ZkIM.exedescription pid process Token: SeDebugPrivilege 996 AVH3viH4ec3ZkIM.exe Token: SeDebugPrivilege 2140 AVH3viH4ec3ZkIM.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
AVH3viH4ec3ZkIM.exedescription pid process target process PID 996 wrote to memory of 3780 996 AVH3viH4ec3ZkIM.exe schtasks.exe PID 996 wrote to memory of 3780 996 AVH3viH4ec3ZkIM.exe schtasks.exe PID 996 wrote to memory of 3780 996 AVH3viH4ec3ZkIM.exe schtasks.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe PID 996 wrote to memory of 2140 996 AVH3viH4ec3ZkIM.exe AVH3viH4ec3ZkIM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AVH3viH4ec3ZkIM.exe"C:\Users\Admin\AppData\Local\Temp\AVH3viH4ec3ZkIM.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ETjFcI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2442.tmp"2⤵
- Creates scheduled task(s)
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\AVH3viH4ec3ZkIM.exe"C:\Users\Admin\AppData\Local\Temp\AVH3viH4ec3ZkIM.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2140
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2442.tmpMD5
377f182ab3f5c5820a9720e978d0361c
SHA1e152b5199c69ac8005645da1a937f825d60badf1
SHA256382650ce856d82f982f68ced24d62bc83c813b4e6c6745e8bd05b887e4423cd6
SHA51279d1edc703fda13c9b7819b4e49c4e1efc29b03c71fe0f2c1a766f36f28400e5e4b00643e22abb4d91dcc6f24adc0d5e6b83b690ee1aebd80e6dc2434941f101
-
memory/996-121-0x0000000001770000-0x000000000177B000-memory.dmpFilesize
44KB
-
memory/996-117-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/996-118-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/996-119-0x0000000005770000-0x0000000005C6E000-memory.dmpFilesize
5.0MB
-
memory/996-120-0x00000000032A0000-0x00000000032A1000-memory.dmpFilesize
4KB
-
memory/996-114-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/996-122-0x0000000007B80000-0x0000000007BE5000-memory.dmpFilesize
404KB
-
memory/996-123-0x0000000005980000-0x00000000059A1000-memory.dmpFilesize
132KB
-
memory/996-116-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/2140-126-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2140-127-0x00000000004139DE-mapping.dmp
-
memory/2140-128-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3780-124-0x0000000000000000-mapping.dmp