Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-12-2021 02:23
Static task
static1
Behavioral task
behavioral1
Sample
d1279da0ffbc04887863ac95a894f275.exe
Resource
win7-en-20211014
General
-
Target
d1279da0ffbc04887863ac95a894f275.exe
-
Size
543KB
-
MD5
d1279da0ffbc04887863ac95a894f275
-
SHA1
b0e8eccb61fd44315e03101ee0084367a8379295
-
SHA256
c004cf20f130b80a6a52e8999ed94795d1fd9f8ae35ccda173bcb2cbeccf3888
-
SHA512
8e723b67cb0fdfd2273b44e04c38ab5fe0c7297153cd3296786cd2dae05cd01ab891086d40f5a21e44e9e4d51f81a7d78be7ab538447d53168ec316156c8bde6
Malware Config
Extracted
lokibot
http://roboticsengineeringtech.xyz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d1279da0ffbc04887863ac95a894f275.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook d1279da0ffbc04887863ac95a894f275.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook d1279da0ffbc04887863ac95a894f275.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exedescription pid process target process PID 3772 set thread context of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exepowershell.exepid process 3772 d1279da0ffbc04887863ac95a894f275.exe 3772 d1279da0ffbc04887863ac95a894f275.exe 3772 d1279da0ffbc04887863ac95a894f275.exe 3772 d1279da0ffbc04887863ac95a894f275.exe 3772 d1279da0ffbc04887863ac95a894f275.exe 3772 d1279da0ffbc04887863ac95a894f275.exe 3736 powershell.exe 3736 powershell.exe 3736 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exepid process 612 d1279da0ffbc04887863ac95a894f275.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exepowershell.exed1279da0ffbc04887863ac95a894f275.exedescription pid process Token: SeDebugPrivilege 3772 d1279da0ffbc04887863ac95a894f275.exe Token: SeDebugPrivilege 3736 powershell.exe Token: SeDebugPrivilege 612 d1279da0ffbc04887863ac95a894f275.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exedescription pid process target process PID 3772 wrote to memory of 3736 3772 d1279da0ffbc04887863ac95a894f275.exe powershell.exe PID 3772 wrote to memory of 3736 3772 d1279da0ffbc04887863ac95a894f275.exe powershell.exe PID 3772 wrote to memory of 3736 3772 d1279da0ffbc04887863ac95a894f275.exe powershell.exe PID 3772 wrote to memory of 3732 3772 d1279da0ffbc04887863ac95a894f275.exe schtasks.exe PID 3772 wrote to memory of 3732 3772 d1279da0ffbc04887863ac95a894f275.exe schtasks.exe PID 3772 wrote to memory of 3732 3772 d1279da0ffbc04887863ac95a894f275.exe schtasks.exe PID 3772 wrote to memory of 1032 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 1032 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 1032 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 1064 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 1064 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 1064 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 608 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 608 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 608 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe PID 3772 wrote to memory of 612 3772 d1279da0ffbc04887863ac95a894f275.exe d1279da0ffbc04887863ac95a894f275.exe -
outlook_office_path 1 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook d1279da0ffbc04887863ac95a894f275.exe -
outlook_win_path 1 IoCs
Processes:
d1279da0ffbc04887863ac95a894f275.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d1279da0ffbc04887863ac95a894f275.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VfZFoFXb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VfZFoFXb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2CB9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"C:\Users\Admin\AppData\Local\Temp\d1279da0ffbc04887863ac95a894f275.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2CB9.tmpMD5
2db07fbcbf4f8d0528144bb1e7d8864d
SHA1a46d494fb092a573743aa4cdccddb343dd0920e6
SHA2560743c96b7e863ade4252ebc4d90ca67b4fd5a7046fd7b3bb749a1c1ccf6ec040
SHA512431fde3ff2d541faf0cc7bcedccef2fea1e28d8be353ad35019322428f6d21755744426e74a69be497ba4594ee87ac9740518a2225df06302d518279c68f6045
-
memory/612-142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/612-136-0x00000000004139DE-mapping.dmp
-
memory/612-135-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3732-129-0x0000000000000000-mapping.dmp
-
memory/3736-143-0x0000000007B90000-0x0000000007B91000-memory.dmpFilesize
4KB
-
memory/3736-146-0x0000000008170000-0x0000000008171000-memory.dmpFilesize
4KB
-
memory/3736-237-0x0000000006B13000-0x0000000006B14000-memory.dmpFilesize
4KB
-
memory/3736-236-0x000000007EFD0000-0x000000007EFD1000-memory.dmpFilesize
4KB
-
memory/3736-128-0x0000000000000000-mapping.dmp
-
memory/3736-167-0x00000000094E0000-0x00000000094E1000-memory.dmpFilesize
4KB
-
memory/3736-130-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/3736-131-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/3736-166-0x0000000009130000-0x0000000009131000-memory.dmpFilesize
4KB
-
memory/3736-133-0x0000000006A50000-0x0000000006A51000-memory.dmpFilesize
4KB
-
memory/3736-134-0x0000000007150000-0x0000000007151000-memory.dmpFilesize
4KB
-
memory/3736-161-0x0000000008F90000-0x0000000008F91000-memory.dmpFilesize
4KB
-
memory/3736-154-0x0000000008FB0000-0x0000000008FE3000-memory.dmpFilesize
204KB
-
memory/3736-137-0x00000000077D0000-0x00000000077D1000-memory.dmpFilesize
4KB
-
memory/3736-138-0x0000000007870000-0x0000000007871000-memory.dmpFilesize
4KB
-
memory/3736-139-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/3736-147-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/3736-141-0x0000000006B12000-0x0000000006B13000-memory.dmpFilesize
4KB
-
memory/3736-140-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/3736-145-0x00000000083F0000-0x00000000083F1000-memory.dmpFilesize
4KB
-
memory/3736-144-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/3772-118-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/3772-125-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3772-120-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/3772-121-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/3772-122-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3772-123-0x0000000004F60000-0x000000000545E000-memory.dmpFilesize
5.0MB
-
memory/3772-124-0x00000000053F0000-0x00000000053F8000-memory.dmpFilesize
32KB
-
memory/3772-127-0x0000000005F20000-0x0000000005F90000-memory.dmpFilesize
448KB
-
memory/3772-126-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB