Analysis
-
max time kernel
99s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe
Resource
win10v2004-20220414-en
General
-
Target
ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe
-
Size
650KB
-
MD5
941d0f71db9a9e67dc3cedc3df532a87
-
SHA1
747f96145ed1897c396647867edbac9a4dbc8495
-
SHA256
ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc
-
SHA512
8393300dd5cfafead4500ad949db3f2cb039005f2786302120d1bbff0374ec6967185b44605a326f9f178e4ea849df4ab984f9a5804ff0caf453ff260de626e6
Malware Config
Extracted
lokibot
http://quehenbergar.com/coke/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1524 set thread context of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1712 schtasks.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1768 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1524 wrote to memory of 1712 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 28 PID 1524 wrote to memory of 1712 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 28 PID 1524 wrote to memory of 1712 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 28 PID 1524 wrote to memory of 1712 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 28 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 PID 1524 wrote to memory of 1768 1524 ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe"C:\Users\Admin\AppData\Local\Temp\ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PkZGXPctPBqF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF24C.tmp"2⤵
- Creates scheduled task(s)
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\ca72b691017823fcf5f5d40b54dff04b9d641c463268fc92c2b66623df19c6bc.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD533c6051b6a924aaebcebe1cca7879602
SHA13a5b6970d219c612c662c98244d87a1869bb1ee1
SHA25639842caaff92cbfb5d51ac9ff088507875e19c00245c56b879aec80c743455a8
SHA512cec2a1a581d2c3362af486db71a78643e73e3e28701c8a6dc2535299b6b78c1745a07842cdebc156e9abfc014c3efcef16fb3e95efd0525746170c9c91ff052f