Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 11:11
Static task
static1
Behavioral task
behavioral1
Sample
aDjBsDXAbSDNi5L.exe
Resource
win7-en-20210920
General
-
Target
aDjBsDXAbSDNi5L.exe
-
Size
428KB
-
MD5
d3653513a4ecdc767beabeb00ad5e98b
-
SHA1
4bc86b0ce232029b9bb9c3d3575cbcec6661a518
-
SHA256
a735a8c9c8454d659554337201d4e401e02df5bb79a921b1a4c25e40f84f1506
-
SHA512
3b0aa6846347e370b3eb7f262eb6c7b8211cbec84352c8c2c7cd95b7d606dfbbf926d114a9e479809db2ad84a1331a437e302c42a2bfbfdb675d22479f502ff0
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=6446112
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
aDjBsDXAbSDNi5L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook aDjBsDXAbSDNi5L.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook aDjBsDXAbSDNi5L.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook aDjBsDXAbSDNi5L.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aDjBsDXAbSDNi5L.exedescription pid process target process PID 2748 set thread context of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
aDjBsDXAbSDNi5L.exepid process 2748 aDjBsDXAbSDNi5L.exe 2748 aDjBsDXAbSDNi5L.exe 2748 aDjBsDXAbSDNi5L.exe 2748 aDjBsDXAbSDNi5L.exe 2748 aDjBsDXAbSDNi5L.exe 2748 aDjBsDXAbSDNi5L.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aDjBsDXAbSDNi5L.exepid process 2628 aDjBsDXAbSDNi5L.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aDjBsDXAbSDNi5L.exeaDjBsDXAbSDNi5L.exedescription pid process Token: SeDebugPrivilege 2748 aDjBsDXAbSDNi5L.exe Token: SeDebugPrivilege 2628 aDjBsDXAbSDNi5L.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
aDjBsDXAbSDNi5L.exedescription pid process target process PID 2748 wrote to memory of 1004 2748 aDjBsDXAbSDNi5L.exe schtasks.exe PID 2748 wrote to memory of 1004 2748 aDjBsDXAbSDNi5L.exe schtasks.exe PID 2748 wrote to memory of 1004 2748 aDjBsDXAbSDNi5L.exe schtasks.exe PID 2748 wrote to memory of 2808 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2808 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2808 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 3436 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 3436 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 3436 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe PID 2748 wrote to memory of 2628 2748 aDjBsDXAbSDNi5L.exe aDjBsDXAbSDNi5L.exe -
outlook_office_path 1 IoCs
Processes:
aDjBsDXAbSDNi5L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook aDjBsDXAbSDNi5L.exe -
outlook_win_path 1 IoCs
Processes:
aDjBsDXAbSDNi5L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook aDjBsDXAbSDNi5L.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DLhpfSjSPZVuA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4581.tmp"2⤵
- Creates scheduled task(s)
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"2⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"2⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"C:\Users\Admin\AppData\Local\Temp\aDjBsDXAbSDNi5L.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-124-0x0000000000000000-mapping.dmp
-
memory/2628-126-0x00000000004139DE-mapping.dmp
-
memory/2628-125-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2628-127-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2748-115-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2748-117-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/2748-118-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/2748-119-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/2748-120-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/2748-121-0x0000000006340000-0x0000000006347000-memory.dmpFilesize
28KB
-
memory/2748-122-0x0000000009270000-0x0000000009271000-memory.dmpFilesize
4KB
-
memory/2748-123-0x0000000009210000-0x000000000924C000-memory.dmpFilesize
240KB