Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
02-11-2021 12:11
Static task
static1
Behavioral task
behavioral1
Sample
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Resource
win10-en-20210920
General
-
Target
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
-
Size
465KB
-
MD5
d0a58eae99dfb90ea4aa5dbf24d2fb93
-
SHA1
83951b727bb85db87b55a3c68d2c7812640a6619
-
SHA256
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967
-
SHA512
399c77be146cffa43bb42aedd1b7a090baedfc175b20e6d2e3cf856359c061c9ebdbae3083e6bb9706d16f11c908dc5c6de5e93083788b12916d06d536d401de
Malware Config
Extracted
lokibot
http://secure01-redirect.net/ga18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process target process PID 4392 set thread context of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exepid process 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process Token: SeDebugPrivilege 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription pid process target process PID 4392 wrote to memory of 3756 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3756 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3756 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3872 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3872 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3872 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 4456 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 4456 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 4456 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe PID 4392 wrote to memory of 3476 4392 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
outlook_office_path 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe -
outlook_win_path 1 IoCs
Processes:
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"C:\Users\Admin\AppData\Local\Temp\5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe"2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3476