Analysis
-
max time kernel
106s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
06-12-2021 11:42
Static task
static1
Behavioral task
behavioral1
Sample
EC0877867457.SCR.exe
Resource
win7-en-20211104
General
-
Target
EC0877867457.SCR.exe
-
Size
1.2MB
-
MD5
a01865e278ece5ffab1a0e6849d3e8c0
-
SHA1
d85fcdb7b83eec227b4d655a3cbd106f7f386602
-
SHA256
40ff5e22f928f47defb8c81c6c141103cdbf82d3faa6ff136f8d88c969b38dad
-
SHA512
1170f19739f5dfcd073d287bb4a2b830a43ae3995ff12e3d39296fad44cad07c36ad74b9b957a39ce4d071ff13a161b3c9ac08bf60c69a15a88d2b5583c09c1f
Malware Config
Extracted
lokibot
http://lokiik.xyz/me/cf/vil.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
EC0877867457.SCR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook EC0877867457.SCR.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook EC0877867457.SCR.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook EC0877867457.SCR.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
EC0877867457.SCR.exedescription pid process target process PID 3652 set thread context of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
EC0877867457.SCR.exepid process 648 EC0877867457.SCR.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EC0877867457.SCR.exedescription pid process Token: SeDebugPrivilege 648 EC0877867457.SCR.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EC0877867457.SCR.exedescription pid process target process PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe PID 3652 wrote to memory of 648 3652 EC0877867457.SCR.exe EC0877867457.SCR.exe -
outlook_office_path 1 IoCs
Processes:
EC0877867457.SCR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook EC0877867457.SCR.exe -
outlook_win_path 1 IoCs
Processes:
EC0877867457.SCR.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook EC0877867457.SCR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EC0877867457.SCR.exe"C:\Users\Admin\AppData\Local\Temp\EC0877867457.SCR.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EC0877867457.SCR.exe"C:\Users\Admin\AppData\Local\Temp\EC0877867457.SCR.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-128-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/648-129-0x00000000004139DE-mapping.dmp
-
memory/648-130-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3652-118-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3652-120-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/3652-121-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/3652-122-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/3652-123-0x0000000005000000-0x0000000005008000-memory.dmpFilesize
32KB
-
memory/3652-124-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/3652-125-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/3652-126-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/3652-127-0x0000000005CD0000-0x0000000005DD2000-memory.dmpFilesize
1.0MB