Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 20:13
Static task
static1
Behavioral task
behavioral1
Sample
Factura comercial.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
Factura comercial.exe
-
Size
556KB
-
MD5
0d4b6d93b2c7624ac7ba28315445380a
-
SHA1
df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4
-
SHA256
5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e
-
SHA512
a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9
Malware Config
Extracted
Family
lokibot
C2
https://pakilogs2020.xyz/t/e/ff.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Factura comercial.exedescription pid process target process PID 484 set thread context of 932 484 Factura comercial.exe Factura comercial.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Factura comercial.exepid process 484 Factura comercial.exe 484 Factura comercial.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Factura comercial.exepid process 932 Factura comercial.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Factura comercial.exeFactura comercial.exedescription pid process Token: SeDebugPrivilege 484 Factura comercial.exe Token: SeDebugPrivilege 932 Factura comercial.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Factura comercial.exedescription pid process target process PID 484 wrote to memory of 784 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 784 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 784 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 784 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe PID 484 wrote to memory of 932 484 Factura comercial.exe Factura comercial.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-59-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB
-
memory/484-61-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/484-62-0x0000000000420000-0x0000000000422000-memory.dmpFilesize
8KB
-
memory/484-63-0x0000000005CF0000-0x0000000005D60000-memory.dmpFilesize
448KB
-
memory/484-64-0x0000000000F30000-0x0000000000F52000-memory.dmpFilesize
136KB
-
memory/932-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/932-66-0x00000000004139DE-mapping.dmp
-
memory/932-67-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/932-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB