Analysis
-
max time kernel
128s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 05:58
Static task
static1
General
-
Target
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe
-
Size
270KB
-
MD5
d031d354378993ddf3aca597f723b301
-
SHA1
b6a6ed3df049e756d57d8d19a22e124b2672ee1c
-
SHA256
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1
-
SHA512
c345a0d66fc8ba3a434e3678f183575cc7de1bebdea2f3474090d28deacb82ce7ecb3f14ee66bfa1df453eee90de9c2a79270aa5e538d1996050f786c3ed51ee
Malware Config
Extracted
lokibot
http://74f26d34ffff049368a6cff8812f86ee.ml/BN22/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Loads dropped DLL 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exepid process 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription pid process target process PID 3168 set thread context of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exepid process 2660 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription pid process Token: SeDebugPrivilege 2660 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription pid process target process PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe PID 3168 wrote to memory of 2660 3168 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
outlook_office_path 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe -
outlook_win_path 1 IoCs
Processes:
5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe"C:\Users\Admin\AppData\Local\Temp\5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe"C:\Users\Admin\AppData\Local\Temp\5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsy1819.tmp\jeqzqzkmkp.dllMD5
8dc3c0063d341a832e27d7c13e815e0f
SHA10be9c4da37598b60604928ec9fcefc69c6a47a0f
SHA256352b436324a87627e2732511330feabe368c4f68cc932cc1d3e1495f786a02ea
SHA512a74c7d9c14d1d7d09295accda0209e1f929231ae1dd0446073bd316cb9a76036f8c9477d3b9e7803e6fbf066c4c5a8a27ad6ce59d99ec51d3748df68e4f41e12
-
memory/2660-116-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2660-117-0x00000000004139DE-mapping.dmp
-
memory/2660-118-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB