Analysis
-
max time kernel
67s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:17
Static task
static1
Behavioral task
behavioral1
Sample
Payment proof .exe
Resource
win7-20220414-en
General
-
Target
Payment proof .exe
-
Size
240KB
-
MD5
39dca7465781450a9bbb87eda01a07b7
-
SHA1
8b490e11ddd090ea5afeb24d327d39bd2f075979
-
SHA256
14e7b4f4f4e98ecb3aad0e67857b3fbbca1d314ecdaa0b1aab122e1d97954977
-
SHA512
66a89b947f31c7469f5daa005c0fdb02f304eed457be5067d59c68b3ab6be19f38ee6a776ef213416abd52babc17bed65ff8b7e77581f2cd871f705192ab79fb
Malware Config
Extracted
lokibot
http://scarfponcho.com/notsite/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Payment proof .exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Payment proof .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Payment proof .exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Payment proof .exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Payment proof .exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Payment proof .exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Payment proof .exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Payment proof .exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Payment proof .exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Payment proof .exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Payment proof .exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Payment proof .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Payment proof .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment proof .exedescription pid process target process PID 1612 set thread context of 1540 1612 Payment proof .exe Payment proof .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1720 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Payment proof .exepid process 1540 Payment proof .exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exePayment proof .exedescription pid process Token: SeDebugPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1540 Payment proof .exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Payment proof .exedescription pid process target process PID 1612 wrote to memory of 1720 1612 Payment proof .exe powershell.exe PID 1612 wrote to memory of 1720 1612 Payment proof .exe powershell.exe PID 1612 wrote to memory of 1720 1612 Payment proof .exe powershell.exe PID 1612 wrote to memory of 1720 1612 Payment proof .exe powershell.exe PID 1612 wrote to memory of 268 1612 Payment proof .exe schtasks.exe PID 1612 wrote to memory of 268 1612 Payment proof .exe schtasks.exe PID 1612 wrote to memory of 268 1612 Payment proof .exe schtasks.exe PID 1612 wrote to memory of 268 1612 Payment proof .exe schtasks.exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe PID 1612 wrote to memory of 1540 1612 Payment proof .exe Payment proof .exe -
outlook_office_path 1 IoCs
Processes:
Payment proof .exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Payment proof .exe -
outlook_win_path 1 IoCs
Processes:
Payment proof .exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Payment proof .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment proof .exe"C:\Users\Admin\AppData\Local\Temp\Payment proof .exe"1⤵
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oADFVyliuQEyVq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCED.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment proof .exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCED.tmpFilesize
1KB
MD50c2df323701614e96870f9d7b539a452
SHA13728b3750fb2b062ab686509031cbe352300fc92
SHA2562bfb342e45315b4110e4505d54ed40a4e88d51b1ae050399d306e78dcd291872
SHA5122bfc49cd6d8404f05652fcc824ddae5ac4ce6593e35621ced30668a5c63cfbdefd11c09a9dcce055b6f1cbd8fbb55c02dcdb2f3c2ae645e210830aec8c144d28
-
memory/268-59-0x0000000000000000-mapping.dmp
-
memory/1540-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-62-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-70-0x00000000004139DE-mapping.dmp
-
memory/1540-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1612-55-0x0000000074AE0000-0x000000007508B000-memory.dmpFilesize
5.7MB
-
memory/1612-54-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1720-58-0x0000000074AE0000-0x000000007508B000-memory.dmpFilesize
5.7MB
-
memory/1720-56-0x0000000000000000-mapping.dmp