Analysis
-
max time kernel
97s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Detalles del banco.pdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
Detalles del banco.pdf.exe
-
Size
538KB
-
MD5
3965feca216cde849f987b614794b46c
-
SHA1
d5fd435edf3348930b1500d9b10b3b010b07ef99
-
SHA256
c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
-
SHA512
684381a00700a14c9c0bb9b4cb337f00057ccd678c825b3ab3b578ee6a98dd7c8a46fb42734be7a51dbb47ef21d03929428ab17ef2be327259d8c99439757c5b
Malware Config
Extracted
Family
lokibot
C2
https://zamloki.xyz/des/co/tox.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Detalles del banco.pdf.exedescription pid process target process PID 4024 set thread context of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Detalles del banco.pdf.exepid process 4024 Detalles del banco.pdf.exe 4024 Detalles del banco.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Detalles del banco.pdf.exepid process 928 Detalles del banco.pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Detalles del banco.pdf.exeDetalles del banco.pdf.exedescription pid process Token: SeDebugPrivilege 4024 Detalles del banco.pdf.exe Token: SeDebugPrivilege 928 Detalles del banco.pdf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Detalles del banco.pdf.exedescription pid process target process PID 4024 wrote to memory of 1320 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 1320 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 1320 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe PID 4024 wrote to memory of 928 4024 Detalles del banco.pdf.exe Detalles del banco.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Detalles del banco.pdf.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/928-124-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/928-125-0x00000000004139DE-mapping.dmp
-
memory/928-126-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4024-114-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4024-116-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/4024-117-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/4024-118-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/4024-119-0x00000000049E0000-0x0000000004EDE000-memory.dmpFilesize
5.0MB
-
memory/4024-120-0x0000000006410000-0x0000000006412000-memory.dmpFilesize
8KB
-
memory/4024-121-0x0000000006650000-0x0000000006651000-memory.dmpFilesize
4KB
-
memory/4024-122-0x0000000008300000-0x000000000836C000-memory.dmpFilesize
432KB
-
memory/4024-123-0x0000000008290000-0x00000000082B1000-memory.dmpFilesize
132KB