Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 08:53
Static task
static1
Behavioral task
behavioral1
Sample
PO 35467833(VN).exe
Resource
win7-en-20211014
General
-
Target
PO 35467833(VN).exe
-
Size
550KB
-
MD5
bdb527c345da49a51e27f2a69c7b7e05
-
SHA1
fce0a4025c531428178aa6bbc4a7009529703988
-
SHA256
4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd
-
SHA512
7c6a3f06781afe1af816ad72a99fa8e8a904b70d6373ca9828546768cad636212bce248213326c8f7eb0fddf1ee41a44b8fe57563b49696411ea698f8b62ecc6
Malware Config
Extracted
lokibot
http://secure01-redirect.net/gb20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PO 35467833(VN).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO 35467833(VN).exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook PO 35467833(VN).exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO 35467833(VN).exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 35467833(VN).exedescription pid process target process PID 2716 set thread context of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
PO 35467833(VN).exepid process 2316 PO 35467833(VN).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 35467833(VN).exedescription pid process Token: SeDebugPrivilege 2316 PO 35467833(VN).exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PO 35467833(VN).exedescription pid process target process PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe PID 2716 wrote to memory of 2316 2716 PO 35467833(VN).exe PO 35467833(VN).exe -
outlook_office_path 1 IoCs
Processes:
PO 35467833(VN).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook PO 35467833(VN).exe -
outlook_win_path 1 IoCs
Processes:
PO 35467833(VN).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook PO 35467833(VN).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2316-128-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2316-129-0x00000000004139DE-mapping.dmp
-
memory/2316-130-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2716-118-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/2716-120-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/2716-121-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/2716-122-0x00000000057F0000-0x0000000005CEE000-memory.dmpFilesize
5.0MB
-
memory/2716-123-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/2716-124-0x0000000005AC0000-0x0000000005AC8000-memory.dmpFilesize
32KB
-
memory/2716-125-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/2716-126-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/2716-127-0x00000000067B0000-0x0000000006825000-memory.dmpFilesize
468KB