Analysis
-
max time kernel
59s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-07-2021 07:51
Static task
static1
Behavioral task
behavioral1
Sample
OrderRequest.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
OrderRequest.exe
-
Size
871KB
-
MD5
52db97007f406b46ae0cc4b82ad882be
-
SHA1
dc5fefda3c4c080ce976c6938cc9bb097ffded63
-
SHA256
10f675a780a5814df0a79b673213a2ed2989816a517797df5656551b0819789c
-
SHA512
dc23eb967f4b0961344ef99f294c1ee593271ee8c29cb7173258614f46994ed4c19dd7645943d9539b6de339082783904d5ad34217be95a2ab76cc60b2bfb67d
Malware Config
Extracted
Family
lokibot
C2
http://ibmcloudstorage.ml/prof2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
OrderRequest.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wuiojpj = "C:\\Users\\Public\\Libraries\\jpjoiuW.url" OrderRequest.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
OrderRequest.exedescription pid process target process PID 1800 set thread context of 696 1800 OrderRequest.exe OrderRequest.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
OrderRequest.exepid process 696 OrderRequest.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
OrderRequest.exedescription pid process Token: SeDebugPrivilege 696 OrderRequest.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
OrderRequest.exedescription pid process target process PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe PID 1800 wrote to memory of 696 1800 OrderRequest.exe OrderRequest.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OrderRequest.exe"C:\Users\Admin\AppData\Local\Temp\OrderRequest.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OrderRequest.exe"C:\Users\Admin\AppData\Local\Temp\OrderRequest.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/696-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/696-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/696-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/696-68-0x00000000004139DE-mapping.dmp
-
memory/696-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-59-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1800-60-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1800-62-0x0000000000340000-0x000000000035A000-memory.dmpFilesize
104KB