Analysis
- max time kernel
110s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/02/2022, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
Wire 0092731.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Wire 0092731.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target Wire 0092731.exe
- Size 699KB
- Sample220210-b34v2acba9
- SHA256 78fd4e091b66540f612e7c3bd324d4bfa1abeebac2487d192f672686d09ed1a1
- MD5 96fa1cd7589340e6a3fd801875e21733
- SHA1 75761125485b8b0a9e8d2f9b08d891f0b8119b0f
- SHA512 96ffb5d30bbddcc618ceed6c7cfe292c047ec27db75f23b552535b370cf1d3a613439b651265a930de223a891e2095e511046845f36c89e704497709c4a74af6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://secure01-redirect.net/gd1/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Wire 0092731.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Wire 0092731.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Wire 0092731.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 892 set thread context of 672 892 Wire 0092731.exe 99 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 672 Wire 0092731.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4108 svchost.exe Token: SeCreatePagefilePrivilege 4108 svchost.exe Token: SeShutdownPrivilege 4108 svchost.exe Token: SeCreatePagefilePrivilege 4108 svchost.exe Token: SeShutdownPrivilege 4108 svchost.exe Token: SeCreatePagefilePrivilege 4108 svchost.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe Token: SeRestorePrivilege 212 TiWorker.exe Token: SeSecurityPrivilege 212 TiWorker.exe Token: SeBackupPrivilege 212 TiWorker.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 PID 892 wrote to memory of 672 892 Wire 0092731.exe 99 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Wire 0092731.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Wire 0092731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wire 0092731.exe"C:\Users\Admin\AppData\Local\Temp\Wire 0092731.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\Wire 0092731.exe"C:\Users\Admin\AppData\Local\Temp\Wire 0092731.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- outlook_office_path
- outlook_win_path
PID:672
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:212