Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 07:30
Static task
static1
Behavioral task
behavioral1
Sample
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
Resource
win7v20210410
General
-
Target
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
-
Size
3.7MB
-
MD5
00fd3c68b44a6e82a6c516e6326dd89f
-
SHA1
a0d06dfc640fcaf4533962a11b4907c2dbbdfc8d
-
SHA256
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30
-
SHA512
92a6b9b7eda12966869d1192c5bc9abc793a1428ef8c0463c18677b03fc6c6ee9482a3559d8c20dc7284167cbecfdc77c58367cab5d9a3b0e83ae91eab3a7bfc
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/594QbwaP456AN
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exedescription pid process target process PID 2256 set thread context of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exepid process 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exede356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exedescription pid process Token: SeDebugPrivilege 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe Token: SeDebugPrivilege 968 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exedescription pid process target process PID 2256 wrote to memory of 1852 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 1852 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 1852 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 2256 wrote to memory of 968 2256 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-124-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/968-125-0x00000000004139DE-mapping.dmp
-
memory/968-126-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2256-114-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/2256-116-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/2256-117-0x0000000005D00000-0x0000000005D01000-memory.dmpFilesize
4KB
-
memory/2256-118-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/2256-119-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2256-120-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/2256-121-0x0000000005800000-0x0000000005CFE000-memory.dmpFilesize
5.0MB
-
memory/2256-122-0x0000000005A20000-0x0000000005A24000-memory.dmpFilesize
16KB
-
memory/2256-123-0x0000000001570000-0x00000000015B8000-memory.dmpFilesize
288KB