Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 08:25
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 11054.exe
Resource
win7-20220414-en
General
-
Target
RFQ 11054.exe
-
Size
448KB
-
MD5
48cf582798fe28db9fa92b590707bf26
-
SHA1
a09432f56a4026499ac2bb1d586ee6d795d8d1cc
-
SHA256
49c361c43361d599dda418898930e755acd9d2d3c9c0cf3b6ff12cd58e1d2aa0
-
SHA512
6c1385d7b999a3f783025eba66397d042026be8b88e1818b1570ac592c3a88c0490fe45dcaf932dc84787cb2e3dce995619f1fc3fa724bdd976dd6a1e0cfb139
Malware Config
Extracted
lokibot
http://sempersim.su/fo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RFQ 11054.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RFQ 11054.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RFQ 11054.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ 11054.exedescription pid process target process PID 1036 set thread context of 1192 1036 RFQ 11054.exe RFQ 11054.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RFQ 11054.exepid process 1036 RFQ 11054.exe 1036 RFQ 11054.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
RFQ 11054.exepid process 1192 RFQ 11054.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ 11054.exeRFQ 11054.exedescription pid process Token: SeDebugPrivilege 1036 RFQ 11054.exe Token: SeDebugPrivilege 1192 RFQ 11054.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
RFQ 11054.exedescription pid process target process PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe PID 1036 wrote to memory of 1192 1036 RFQ 11054.exe RFQ 11054.exe -
outlook_office_path 1 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RFQ 11054.exe -
outlook_win_path 1 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RFQ 11054.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-54-0x0000000000A90000-0x0000000000B04000-memory.dmpFilesize
464KB
-
memory/1036-55-0x0000000075941000-0x0000000075943000-memory.dmpFilesize
8KB
-
memory/1036-56-0x0000000000610000-0x0000000000626000-memory.dmpFilesize
88KB
-
memory/1036-57-0x0000000007285000-0x0000000007296000-memory.dmpFilesize
68KB
-
memory/1036-58-0x0000000000980000-0x000000000098A000-memory.dmpFilesize
40KB
-
memory/1036-59-0x0000000002130000-0x0000000002188000-memory.dmpFilesize
352KB
-
memory/1036-60-0x0000000002020000-0x0000000002040000-memory.dmpFilesize
128KB
-
memory/1036-73-0x0000000007285000-0x0000000007296000-memory.dmpFilesize
68KB
-
memory/1192-62-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-70-0x00000000004139DE-mapping.dmp
-
memory/1192-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-75-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1192-76-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB