Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 17:39
Static task
static1
Behavioral task
behavioral1
Sample
Richiesta di Offerta.exe
Resource
win7-20220414-en
General
-
Target
Richiesta di Offerta.exe
-
Size
564KB
-
MD5
b95724c316ffbab837bc0449557aca7a
-
SHA1
60bdf46e1a4949b30593737a263b31dd9b0cbcb5
-
SHA256
72bc6c78b71fb0a8b5a668c369e115df3eed9d8d74f19fc3eed683e19fc9c0ac
-
SHA512
6b08f3120807d35315db5833bb91cabfb91c495236665a041155db05be3bd185247f3b1123d4291bbbbd2f6b6ee9987c647c89cd8499ddb776c0aa4982c07890
Malware Config
Extracted
lokibot
http://matbin.com/wp-includes/colors/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Richiesta di Offerta.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exedescription pid process target process PID 1608 set thread context of 1680 1608 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 set thread context of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe -
Drops file in Windows directory 2 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exedescription ioc process File opened for modification C:\Windows\win.ini Richiesta di Offerta.exe File opened for modification C:\Windows\win.ini Richiesta di Offerta.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Richiesta di Offerta.exepid process 1184 Richiesta di Offerta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Richiesta di Offerta.exedescription pid process Token: SeDebugPrivilege 1184 Richiesta di Offerta.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exepid process 1608 Richiesta di Offerta.exe 1680 Richiesta di Offerta.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exedescription pid process target process PID 1608 wrote to memory of 1680 1608 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1608 wrote to memory of 1680 1608 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1608 wrote to memory of 1680 1608 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1608 wrote to memory of 1680 1608 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1680 wrote to memory of 1184 1680 Richiesta di Offerta.exe Richiesta di Offerta.exe -
outlook_office_path 1 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe -
outlook_win_path 1 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Richiesta di Offerta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\win.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1184-93-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1184-92-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1184-91-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1184-87-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1184-82-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1184-83-0x00000000004139DE-mapping.dmp
-
memory/1608-66-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-79-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-67-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-68-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-69-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-70-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-71-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-72-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-73-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-74-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-75-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-76-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-78-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-56-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/1608-77-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-65-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-64-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-63-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-60-0x0000000000280000-0x000000000028C000-memory.dmpFilesize
48KB
-
memory/1608-61-0x0000000077A70000-0x0000000077C19000-memory.dmpFilesize
1.7MB
-
memory/1608-62-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1608-88-0x0000000077C50000-0x0000000077DD0000-memory.dmpFilesize
1.5MB
-
memory/1680-89-0x0000000077C60000-0x0000000077D36000-memory.dmpFilesize
856KB
-
memory/1680-86-0x0000000077A70000-0x0000000077C19000-memory.dmpFilesize
1.7MB
-
memory/1680-84-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/1680-57-0x0000000000000000-mapping.dmp