Analysis
-
max time kernel
131s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-11-2021 08:27
Static task
static1
Behavioral task
behavioral1
Sample
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Resource
win10-en-20211014
General
-
Target
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
-
Size
465KB
-
MD5
d0a58eae99dfb90ea4aa5dbf24d2fb93
-
SHA1
83951b727bb85db87b55a3c68d2c7812640a6619
-
SHA256
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967
-
SHA512
399c77be146cffa43bb42aedd1b7a090baedfc175b20e6d2e3cf856359c061c9ebdbae3083e6bb9706d16f11c908dc5c6de5e93083788b12916d06d536d401de
Malware Config
Extracted
lokibot
http://secure01-redirect.net/ga18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process target process PID 2660 set thread context of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exepid process 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exepid process 3864 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process Token: SeDebugPrivilege 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe Token: SeDebugPrivilege 3864 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process target process PID 2660 wrote to memory of 1808 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 1808 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 1808 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 2660 wrote to memory of 3864 2660 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
outlook_office_path 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
outlook_win_path 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3864