Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
CQ GGM 41pcs F2.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CQ GGM 41pcs F2.doc.exe
Resource
win10v2004-20220414-en
General
-
Target
CQ GGM 41pcs F2.doc.exe
-
Size
280KB
-
MD5
c90dcca549e008b786c0e3754c8ecc6e
-
SHA1
1a8944c37e16284acce6ab47f922cd8145817c58
-
SHA256
e29652502d36677f45a5331102267daea34b2be41bad5c1c12601275d45f3ae3
-
SHA512
ac31f2d330ac6755641865b904b539ffc9853889068701c122c352177646aac2bb5ffb3d9580914fb08bcc9c998feed9441fc623dbbcbbbf9f43d33105fb4880
Malware Config
Extracted
lokibot
http://flexpak-th.com/osama/aboki/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook CQ GGM 41pcs F2.doc.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook CQ GGM 41pcs F2.doc.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook CQ GGM 41pcs F2.doc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription pid process target process PID 1164 set thread context of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
CQ GGM 41pcs F2.doc.exepid process 4296 CQ GGM 41pcs F2.doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription pid process Token: SeDebugPrivilege 4296 CQ GGM 41pcs F2.doc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription pid process target process PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe PID 1164 wrote to memory of 4296 1164 CQ GGM 41pcs F2.doc.exe CQ GGM 41pcs F2.doc.exe -
outlook_office_path 1 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook CQ GGM 41pcs F2.doc.exe -
outlook_win_path 1 IoCs
Processes:
CQ GGM 41pcs F2.doc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook CQ GGM 41pcs F2.doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CQ GGM 41pcs F2.doc.exe"C:\Users\Admin\AppData\Local\Temp\CQ GGM 41pcs F2.doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\CQ GGM 41pcs F2.doc.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4296
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-130-0x0000000000B30000-0x0000000000B7C000-memory.dmpFilesize
304KB
-
memory/1164-131-0x0000000005A90000-0x0000000006034000-memory.dmpFilesize
5.6MB
-
memory/1164-132-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/1164-133-0x0000000005620000-0x00000000056BC000-memory.dmpFilesize
624KB
-
memory/4296-134-0x0000000000000000-mapping.dmp
-
memory/4296-135-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4296-137-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4296-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB