Analysis
- max time kernel
175s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
BORRADOR BL22.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BORRADOR BL22.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target BORRADOR BL22.exe
- Size 545KB
- Sample220208-fa43jsdeb5
- SHA256 94e1a23b8e90cdb1f997fa80bea358193cb0c5c2b2fc6f54a3137cdc604846f5
- MD5 58b7c31cae2710f35aa110fa59c661bc
- SHA1 e67e311cbe4c16cb628144cc603fa6d2d40ce693
- SHA512 081b5cb20ddc62c45ebcf42d1ffe1c7284bcb9b3cf6c9916fa7acbb42a4fb90c95f7ec75f2913a37b2924c796c0eef100e2d5c21583ea4f5a076e45c0efef41e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://63.250.35.245/image.php?view=12346548814841067
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5012 ips.exe 900 ips.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ips.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ips.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ips.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4040 set thread context of 4608 4040 BORRADOR BL22.exe 91 PID 5012 set thread context of 900 5012 ips.exe 107 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2008 schtasks.exe 2708 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4040 BORRADOR BL22.exe Token: SeShutdownPrivilege 4584 svchost.exe Token: SeCreatePagefilePrivilege 4584 svchost.exe Token: SeShutdownPrivilege 4584 svchost.exe Token: SeCreatePagefilePrivilege 4584 svchost.exe Token: SeShutdownPrivilege 4584 svchost.exe Token: SeCreatePagefilePrivilege 4584 svchost.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeDebugPrivilege 5012 ips.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe Token: SeSecurityPrivilege 2756 TiWorker.exe Token: SeBackupPrivilege 2756 TiWorker.exe Token: SeRestorePrivilege 2756 TiWorker.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 4608 4040 BORRADOR BL22.exe 91 PID 4040 wrote to memory of 2384 4040 BORRADOR BL22.exe 94 PID 4040 wrote to memory of 2384 4040 BORRADOR BL22.exe 94 PID 4040 wrote to memory of 2384 4040 BORRADOR BL22.exe 94 PID 4040 wrote to memory of 3364 4040 BORRADOR BL22.exe 96 PID 4040 wrote to memory of 3364 4040 BORRADOR BL22.exe 96 PID 4040 wrote to memory of 3364 4040 BORRADOR BL22.exe 96 PID 4040 wrote to memory of 2764 4040 BORRADOR BL22.exe 95 PID 4040 wrote to memory of 2764 4040 BORRADOR BL22.exe 95 PID 4040 wrote to memory of 2764 4040 BORRADOR BL22.exe 95 PID 3364 wrote to memory of 2008 3364 cmd.exe 100 PID 3364 wrote to memory of 2008 3364 cmd.exe 100 PID 3364 wrote to memory of 2008 3364 cmd.exe 100 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 900 5012 ips.exe 107 PID 5012 wrote to memory of 4064 5012 ips.exe 108 PID 5012 wrote to memory of 4064 5012 ips.exe 108 PID 5012 wrote to memory of 4064 5012 ips.exe 108 PID 5012 wrote to memory of 3408 5012 ips.exe 109 PID 5012 wrote to memory of 3408 5012 ips.exe 109 PID 5012 wrote to memory of 3408 5012 ips.exe 109 PID 5012 wrote to memory of 2096 5012 ips.exe 110 PID 5012 wrote to memory of 2096 5012 ips.exe 110 PID 5012 wrote to memory of 2096 5012 ips.exe 110 PID 3408 wrote to memory of 2708 3408 cmd.exe 114 PID 3408 wrote to memory of 2708 3408 cmd.exe 114 PID 3408 wrote to memory of 2708 3408 cmd.exe 114 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ips.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ips.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BORRADOR BL22.exe"C:\Users\Admin\AppData\Local\Temp\BORRADOR BL22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BORRADOR BL22.exe"C:\Users\Admin\AppData\Local\Temp\BORRADOR BL22.exe"2⤵PID:4608
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\ips"2⤵PID:2384
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\BORRADOR BL22.exe" "C:\Users\Admin\AppData\Roaming\ips\ips.exe"2⤵PID:2764
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\ips\ips.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\ips\ips.exe'" /f3⤵
- Creates scheduled task(s)
PID:2008
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
C:\Users\Admin\AppData\Roaming\ips\ips.exeC:\Users\Admin\AppData\Roaming\ips\ips.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Roaming\ips\ips.exe"C:\Users\Admin\AppData\Roaming\ips\ips.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:900
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\ips"2⤵PID:4064
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\ips\ips.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\ips\ips.exe'" /f3⤵
- Creates scheduled task(s)
PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\ips\ips.exe" "C:\Users\Admin\AppData\Roaming\ips\ips.exe"2⤵PID:2096
-