Analysis
-
max time kernel
115s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-07-2022 13:41
Static task
static1
Behavioral task
behavioral1
Sample
Informe bancario.pdf.exe
Resource
win7-20220414-en
General
-
Target
Informe bancario.pdf.exe
-
Size
490KB
-
MD5
3478108e177eb3a67ac16b398ab58918
-
SHA1
f3e9c0542a332192856efccc7a023fd4f5d89e5a
-
SHA256
a34e892192ae65805daa3aeb9eb0aefcbf2b4d55c31ab0468d91b93c7c3f7a6f
-
SHA512
1a721e709123c89d9172802b6149a26bbbe47d26a3cd579d60981053f09e691caf595503dc3427d3a83de9e28d2b118e93ba8d0ce2a95405ac4837dfe4107e0e
Malware Config
Extracted
lokibot
http://kossa.xyz/esi/pp/play.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Informe bancario.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Informe bancario.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Informe bancario.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Informe bancario.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Informe bancario.pdf.exedescription pid process target process PID 2664 set thread context of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Informe bancario.pdf.exepid process 3708 Informe bancario.pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Informe bancario.pdf.exedescription pid process Token: SeDebugPrivilege 3708 Informe bancario.pdf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Informe bancario.pdf.exedescription pid process target process PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe PID 2664 wrote to memory of 3708 2664 Informe bancario.pdf.exe Informe bancario.pdf.exe -
outlook_office_path 1 IoCs
Processes:
Informe bancario.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Informe bancario.pdf.exe -
outlook_win_path 1 IoCs
Processes:
Informe bancario.pdf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Informe bancario.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Informe bancario.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Informe bancario.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Informe bancario.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Informe bancario.pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2664-130-0x0000000000EB0000-0x0000000000F30000-memory.dmpFilesize
512KB
-
memory/2664-131-0x0000000005D80000-0x0000000006324000-memory.dmpFilesize
5.6MB
-
memory/2664-132-0x00000000057D0000-0x0000000005862000-memory.dmpFilesize
584KB
-
memory/2664-133-0x0000000005A70000-0x0000000005A7A000-memory.dmpFilesize
40KB
-
memory/2664-134-0x0000000009220000-0x00000000092BC000-memory.dmpFilesize
624KB
-
memory/3708-135-0x0000000000000000-mapping.dmp
-
memory/3708-136-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3708-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3708-139-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3708-140-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB