Analysis
-
max time kernel
55s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7v20210410
General
-
Target
gunzipped.exe
-
Size
564KB
-
MD5
012678f684c305c94134a4c816fff242
-
SHA1
493521556f140df3b2670b8b28816a24a4676bdb
-
SHA256
875ab4a8c0e8976f706fe0417ccfdf4d78bab6c845f4b3bb5a9e79414cf34c6d
-
SHA512
931477bbb18f152b1daabd63828b63441e050ecfb1326c5e36e0459076e82b36cd94cb8e050c9a0678fc221a75514456ded795d3b7854194434ae90d79618f5b
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/g2LTjC0V14aJY
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/4036-121-0x0000000005CB0000-0x0000000005CBB000-memory.dmp CustAttr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gunzipped.exedescription pid process target process PID 4036 set thread context of 3960 4036 gunzipped.exe gunzipped.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
gunzipped.exepid process 3960 gunzipped.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
gunzipped.exedescription pid process Token: SeDebugPrivilege 3960 gunzipped.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
gunzipped.exedescription pid process target process PID 4036 wrote to memory of 2852 4036 gunzipped.exe schtasks.exe PID 4036 wrote to memory of 2852 4036 gunzipped.exe schtasks.exe PID 4036 wrote to memory of 2852 4036 gunzipped.exe schtasks.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe PID 4036 wrote to memory of 3960 4036 gunzipped.exe gunzipped.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PVVekGo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBED1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBED1.tmpMD5
fee1c52d6227c60acb6f8df94e8245af
SHA1525f8d71a5b1a6d8d653e8bedcdc67a38c4737c1
SHA2569a579a47a87d0989674d6f7dc8f29e6038de9ff13a3b64cc18a44bf089523ce2
SHA51266a887815bbab0ee607f929379fd64f852bd5c4fadb7dd381e3364cc57f7c86dd520757b4357d5382626bfdfa9e94ef0128934598e38b4e97809cccbc4d1af03
-
memory/2852-124-0x0000000000000000-mapping.dmp
-
memory/3960-128-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3960-127-0x00000000004139DE-mapping.dmp
-
memory/3960-126-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4036-118-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/4036-121-0x0000000005CB0000-0x0000000005CBB000-memory.dmpFilesize
44KB
-
memory/4036-122-0x0000000007D00000-0x0000000007D61000-memory.dmpFilesize
388KB
-
memory/4036-123-0x0000000007560000-0x0000000007582000-memory.dmpFilesize
136KB
-
memory/4036-120-0x00000000056E0000-0x000000000577C000-memory.dmpFilesize
624KB
-
memory/4036-119-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/4036-114-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/4036-117-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/4036-116-0x0000000005D00000-0x0000000005D01000-memory.dmpFilesize
4KB