Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
25-10-2021 07:30
Static task
static1
General
-
Target
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe
-
Size
420KB
-
MD5
90397a5fdff62ca9efc2e2edb989f88f
-
SHA1
ee5a253e9589385e41b1a39b740d2eaac6804ed7
-
SHA256
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0
-
SHA512
992d03e15b6bf92ebbf51bf51efaf36d92c0f75ea001a523c16406ab2254bf8adb4998881948775d28e51fe13ca433f39eccc6627076dcd66e348eec8357eba6
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=9099522
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription pid process target process PID 3316 set thread context of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exepid process 3964 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription pid process Token: SeDebugPrivilege 3964 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription pid process target process PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe PID 3316 wrote to memory of 3964 3316 c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
outlook_office_path 1 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe -
outlook_win_path 1 IoCs
Processes:
c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe"C:\Users\Admin\AppData\Local\Temp\c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe"C:\Users\Admin\AppData\Local\Temp\c35926d69dc7156a41885046951fdbc724e3aabeb3178f206d1829e27ba462e0.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3316-115-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/3316-117-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/3316-118-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/3316-119-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/3316-120-0x0000000004C20000-0x000000000511E000-memory.dmpFilesize
5.0MB
-
memory/3316-121-0x00000000059B0000-0x00000000059B7000-memory.dmpFilesize
28KB
-
memory/3316-122-0x00000000088E0000-0x00000000088E1000-memory.dmpFilesize
4KB
-
memory/3316-123-0x0000000008880000-0x00000000088BC000-memory.dmpFilesize
240KB
-
memory/3964-124-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3964-125-0x00000000004139DE-mapping.dmp
-
memory/3964-126-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB