Analysis
- max time kernel
156s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
bfb7cf452cd8a02c92db0a061af93cef.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bfb7cf452cd8a02c92db0a061af93cef.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target bfb7cf452cd8a02c92db0a061af93cef.exe
- Size 284KB
- Sample220217-wsl8fsche6
- SHA256 a7cf21f805ef16fbd76bd7296aa3326437aaa4a1fc7a8391e3455a24e4da9028
- MD5 bfb7cf452cd8a02c92db0a061af93cef
- SHA1 a0706b66af31eb06038358a5537814c6355fb769
- SHA512 011351b2e9e9ba4dd8a6501e04200660045c66e3bbe672d09a0f189aed7834c66179c87055be64200bd1062bd4ad3c37a2350116e1a7b9c6f7a4bed6b18fab61
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://63.250.35.245/image.php?view=49922917248520685
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2416 smdtpmoafb.exe 4628 smdtpmoafb.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook smdtpmoafb.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook smdtpmoafb.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook smdtpmoafb.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2416 set thread context of 4628 2416 smdtpmoafb.exe 83 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4628 smdtpmoafb.exe Token: SeShutdownPrivilege 5000 svchost.exe Token: SeCreatePagefilePrivilege 5000 svchost.exe Token: SeShutdownPrivilege 5000 svchost.exe Token: SeCreatePagefilePrivilege 5000 svchost.exe Token: SeShutdownPrivilege 5000 svchost.exe Token: SeCreatePagefilePrivilege 5000 svchost.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe Token: SeBackupPrivilege 3336 TiWorker.exe Token: SeRestorePrivilege 3336 TiWorker.exe Token: SeSecurityPrivilege 3336 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3256 wrote to memory of 2416 3256 bfb7cf452cd8a02c92db0a061af93cef.exe 81 PID 3256 wrote to memory of 2416 3256 bfb7cf452cd8a02c92db0a061af93cef.exe 81 PID 3256 wrote to memory of 2416 3256 bfb7cf452cd8a02c92db0a061af93cef.exe 81 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 PID 2416 wrote to memory of 4628 2416 smdtpmoafb.exe 83 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook smdtpmoafb.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook smdtpmoafb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb7cf452cd8a02c92db0a061af93cef.exe"C:\Users\Admin\AppData\Local\Temp\bfb7cf452cd8a02c92db0a061af93cef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\smdtpmoafb.exeC:\Users\Admin\AppData\Local\Temp\smdtpmoafb.exe C:\Users\Admin\AppData\Local\Temp\atggd2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\smdtpmoafb.exeC:\Users\Admin\AppData\Local\Temp\smdtpmoafb.exe C:\Users\Admin\AppData\Local\Temp\atggd3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4628
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3336