Analysis
-
max time kernel
133s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 17:39
Static task
static1
Behavioral task
behavioral1
Sample
Richiesta di Offerta.exe
Resource
win7-20220414-en
General
-
Target
Richiesta di Offerta.exe
-
Size
564KB
-
MD5
b95724c316ffbab837bc0449557aca7a
-
SHA1
60bdf46e1a4949b30593737a263b31dd9b0cbcb5
-
SHA256
72bc6c78b71fb0a8b5a668c369e115df3eed9d8d74f19fc3eed683e19fc9c0ac
-
SHA512
6b08f3120807d35315db5833bb91cabfb91c495236665a041155db05be3bd185247f3b1123d4291bbbbd2f6b6ee9987c647c89cd8499ddb776c0aa4982c07890
Malware Config
Extracted
lokibot
http://matbin.com/wp-includes/colors/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Richiesta di Offerta.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Richiesta di Offerta.exedescription pid process target process PID 1500 set thread context of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe -
Drops file in Windows directory 2 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exedescription ioc process File opened for modification C:\Windows\win.ini Richiesta di Offerta.exe File opened for modification C:\Windows\win.ini Richiesta di Offerta.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Richiesta di Offerta.exepid process 1760 Richiesta di Offerta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Richiesta di Offerta.exedescription pid process Token: SeDebugPrivilege 1760 Richiesta di Offerta.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exepid process 2704 Richiesta di Offerta.exe 1500 Richiesta di Offerta.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Richiesta di Offerta.exeRichiesta di Offerta.exedescription pid process target process PID 2704 wrote to memory of 1500 2704 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 2704 wrote to memory of 1500 2704 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 2704 wrote to memory of 1500 2704 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe PID 1500 wrote to memory of 1760 1500 Richiesta di Offerta.exe Richiesta di Offerta.exe -
outlook_office_path 1 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Richiesta di Offerta.exe -
outlook_win_path 1 IoCs
Processes:
Richiesta di Offerta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Richiesta di Offerta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"C:\Users\Admin\AppData\Local\Temp\Richiesta di Offerta.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\win.iniFilesize
123B
MD56bf517432f65eb7f0d18d574bf14124c
SHA15b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA2566e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA5127b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06
-
memory/1500-145-0x00007FF906810000-0x00007FF906A05000-memory.dmpFilesize
2.0MB
-
memory/1500-133-0x0000000000000000-mapping.dmp
-
memory/1500-142-0x00000000020E0000-0x00000000020EC000-memory.dmpFilesize
48KB
-
memory/1500-146-0x0000000077061000-0x0000000077181000-memory.dmpFilesize
1.1MB
-
memory/1760-141-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1760-144-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1760-140-0x0000000000000000-mapping.dmp
-
memory/1760-147-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1760-148-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1760-149-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2704-132-0x0000000000690000-0x000000000069C000-memory.dmpFilesize
48KB
-
memory/2704-139-0x0000000000690000-0x000000000069C000-memory.dmpFilesize
48KB
-
memory/2704-137-0x0000000077060000-0x0000000077203000-memory.dmpFilesize
1.6MB
-
memory/2704-136-0x00007FF906810000-0x00007FF906A05000-memory.dmpFilesize
2.0MB