Analysis
- max time kernel
130s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
c82c6bdb3e6c126ed700415933fa5799.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target c82c6bdb3e6c126ed700415933fa5799.exe
- Size 256KB
- Sample220209-tdcdlabael
- SHA256 28c032ab919a44daf3acb9de39d54b46007378fb6eb62e5b140ef7b366913a27
- MD5 c82c6bdb3e6c126ed700415933fa5799
- SHA1 04e7cd216ef3ebd0ec94878f7790a528be993c39
- SHA512 78a7a4132a53abbce0b104587b3b4618a25ece756cd98512015a6b2a84839f8edc4d7cc37aa5b982bf5d8c47c854142225f7fc019527f3bbf454d0bab9a424ac
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://asiaoil.bar//bobby/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Executes dropped EXE 2 IoCs
pid Process 5044 gfztanal.exe 5000 gfztanal.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook gfztanal.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook gfztanal.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook gfztanal.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5044 set thread context of 5000 5044 gfztanal.exe 83 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5000 gfztanal.exe Token: SeShutdownPrivilege 644 svchost.exe Token: SeCreatePagefilePrivilege 644 svchost.exe Token: SeShutdownPrivilege 644 svchost.exe Token: SeCreatePagefilePrivilege 644 svchost.exe Token: SeShutdownPrivilege 644 svchost.exe Token: SeCreatePagefilePrivilege 644 svchost.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe Token: SeBackupPrivilege 2596 TiWorker.exe Token: SeRestorePrivilege 2596 TiWorker.exe Token: SeSecurityPrivilege 2596 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4868 wrote to memory of 5044 4868 c82c6bdb3e6c126ed700415933fa5799.exe 82 PID 4868 wrote to memory of 5044 4868 c82c6bdb3e6c126ed700415933fa5799.exe 82 PID 4868 wrote to memory of 5044 4868 c82c6bdb3e6c126ed700415933fa5799.exe 82 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 PID 5044 wrote to memory of 5000 5044 gfztanal.exe 83 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook gfztanal.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook gfztanal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c82c6bdb3e6c126ed700415933fa5799.exe"C:\Users\Admin\AppData\Local\Temp\c82c6bdb3e6c126ed700415933fa5799.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\gfztanal.exeC:\Users\Admin\AppData\Local\Temp\gfztanal.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\gfztanal.exeC:\Users\Admin\AppData\Local\Temp\gfztanal.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5000
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:644
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2596