Analysis
-
max time kernel
121s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 08:25
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 11054.exe
Resource
win7-20220414-en
General
-
Target
RFQ 11054.exe
-
Size
448KB
-
MD5
48cf582798fe28db9fa92b590707bf26
-
SHA1
a09432f56a4026499ac2bb1d586ee6d795d8d1cc
-
SHA256
49c361c43361d599dda418898930e755acd9d2d3c9c0cf3b6ff12cd58e1d2aa0
-
SHA512
6c1385d7b999a3f783025eba66397d042026be8b88e1818b1570ac592c3a88c0490fe45dcaf932dc84787cb2e3dce995619f1fc3fa724bdd976dd6a1e0cfb139
Malware Config
Extracted
lokibot
http://sempersim.su/fo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RFQ 11054.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RFQ 11054.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RFQ 11054.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ 11054.exedescription pid process target process PID 4088 set thread context of 2200 4088 RFQ 11054.exe RFQ 11054.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RFQ 11054.exepid process 4088 RFQ 11054.exe 4088 RFQ 11054.exe 4088 RFQ 11054.exe 4088 RFQ 11054.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
RFQ 11054.exepid process 2200 RFQ 11054.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ 11054.exeRFQ 11054.exedescription pid process Token: SeDebugPrivilege 4088 RFQ 11054.exe Token: SeDebugPrivilege 2200 RFQ 11054.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
RFQ 11054.exedescription pid process target process PID 4088 wrote to memory of 3440 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 3440 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 3440 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe PID 4088 wrote to memory of 2200 4088 RFQ 11054.exe RFQ 11054.exe -
outlook_office_path 1 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RFQ 11054.exe -
outlook_win_path 1 IoCs
Processes:
RFQ 11054.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RFQ 11054.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 11054.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-135-0x0000000000000000-mapping.dmp
-
memory/2200-136-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2200-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2200-139-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2200-140-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3440-134-0x0000000000000000-mapping.dmp
-
memory/4088-130-0x0000000000620000-0x0000000000694000-memory.dmpFilesize
464KB
-
memory/4088-131-0x0000000007C70000-0x0000000008214000-memory.dmpFilesize
5.6MB
-
memory/4088-132-0x0000000007760000-0x00000000077F2000-memory.dmpFilesize
584KB
-
memory/4088-133-0x000000000AE10000-0x000000000AEAC000-memory.dmpFilesize
624KB