Analysis
-
max time kernel
98s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Detalles del banco.pdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
Detalles del banco.pdf.exe
-
Size
538KB
-
MD5
3965feca216cde849f987b614794b46c
-
SHA1
d5fd435edf3348930b1500d9b10b3b010b07ef99
-
SHA256
c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
-
SHA512
684381a00700a14c9c0bb9b4cb337f00057ccd678c825b3ab3b578ee6a98dd7c8a46fb42734be7a51dbb47ef21d03929428ab17ef2be327259d8c99439757c5b
Malware Config
Extracted
Family
lokibot
C2
https://zamloki.xyz/des/co/tox.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Detalles del banco.pdf.exedescription pid process target process PID 2000 set thread context of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Detalles del banco.pdf.exepid process 2000 Detalles del banco.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Detalles del banco.pdf.exepid process 620 Detalles del banco.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Detalles del banco.pdf.exeDetalles del banco.pdf.exedescription pid process Token: SeDebugPrivilege 2000 Detalles del banco.pdf.exe Token: SeDebugPrivilege 620 Detalles del banco.pdf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Detalles del banco.pdf.exedescription pid process target process PID 2000 wrote to memory of 1508 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 1508 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 1508 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 1508 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 2000 wrote to memory of 620 2000 Detalles del banco.pdf.exe Detalles del banco.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/620-66-0x00000000004139DE-mapping.dmp
-
memory/620-67-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/620-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-59-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2000-61-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/2000-62-0x0000000000620000-0x0000000000622000-memory.dmpFilesize
8KB
-
memory/2000-63-0x0000000004FC0000-0x000000000502C000-memory.dmpFilesize
432KB
-
memory/2000-64-0x0000000004740000-0x0000000004761000-memory.dmpFilesize
132KB