Analysis
-
max time kernel
108s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 08:10
Static task
static1
Behavioral task
behavioral1
Sample
f184c7be5715b6cee3458d2b830788cf.exe
Resource
win7-en-20210920
General
-
Target
f184c7be5715b6cee3458d2b830788cf.exe
-
Size
263KB
-
MD5
f184c7be5715b6cee3458d2b830788cf
-
SHA1
83134dbda0337c6f5a41773b6d430bd227b4d6bf
-
SHA256
c2853161b03051757ee439842cf28a6526872c9898183a21deeb7fca109e4ff6
-
SHA512
4e89ae3793afd18a79c94a7cdddcbbea2122f5c133e7b6f30960b7076343325df4c2fb72b9a0f8e06c3dc4d70831d7b3f97db04a33eb32988babefa9d8254bbb
Malware Config
Extracted
lokibot
http://bobbyelectronics.xyz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f184c7be5715b6cee3458d2b830788cf.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook f184c7be5715b6cee3458d2b830788cf.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f184c7be5715b6cee3458d2b830788cf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exedescription pid process target process PID 3304 set thread context of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exepid process 3304 f184c7be5715b6cee3458d2b830788cf.exe 3304 f184c7be5715b6cee3458d2b830788cf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exepid process 3696 f184c7be5715b6cee3458d2b830788cf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exef184c7be5715b6cee3458d2b830788cf.exedescription pid process Token: SeDebugPrivilege 3304 f184c7be5715b6cee3458d2b830788cf.exe Token: SeDebugPrivilege 3696 f184c7be5715b6cee3458d2b830788cf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exedescription pid process target process PID 3304 wrote to memory of 3292 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3292 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3292 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe PID 3304 wrote to memory of 3696 3304 f184c7be5715b6cee3458d2b830788cf.exe f184c7be5715b6cee3458d2b830788cf.exe -
outlook_office_path 1 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f184c7be5715b6cee3458d2b830788cf.exe -
outlook_win_path 1 IoCs
Processes:
f184c7be5715b6cee3458d2b830788cf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f184c7be5715b6cee3458d2b830788cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"2⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"C:\Users\Admin\AppData\Local\Temp\f184c7be5715b6cee3458d2b830788cf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3304-116-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/3304-118-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/3304-119-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/3304-120-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/3304-121-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/3304-122-0x00000000056C0000-0x00000000056C7000-memory.dmpFilesize
28KB
-
memory/3304-123-0x0000000006100000-0x0000000006101000-memory.dmpFilesize
4KB
-
memory/3304-124-0x0000000006060000-0x000000000609C000-memory.dmpFilesize
240KB
-
memory/3696-125-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3696-126-0x00000000004139DE-mapping.dmp
-
memory/3696-127-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB