Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 08:36
Static task
static1
Behavioral task
behavioral1
Sample
sug11.exe
Resource
win7-20220414-en
General
-
Target
sug11.exe
-
Size
549KB
-
MD5
77c2cb4dc872da61727bcb1d9fa9d80f
-
SHA1
2b0a0ca69fe8a0d507e0db2a29eaf4bb00a95c0e
-
SHA256
a5484d4719b1e940afabc2e5cb433edd3578641b23548a8e078f6f8d02ac6db8
-
SHA512
a02886e2dcad25fafb48a52ea341a818185cb5450593a206897d059944b65345f6a8588b1731a2a60d97684c1536c03aefcecab3bdb6e0972e384fdad2bb65dc
Malware Config
Extracted
lokibot
http://45.133.1.20/rostov2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://�����������Ѝ������Й���Й��я��
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
sug11.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook sug11.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook sug11.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook sug11.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sug11.exedescription pid process target process PID 1828 set thread context of 2024 1828 sug11.exe sug11.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
sug11.exepid process 2024 sug11.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sug11.exedescription pid process Token: SeDebugPrivilege 2024 sug11.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
sug11.exedescription pid process target process PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe PID 1828 wrote to memory of 2024 1828 sug11.exe sug11.exe -
outlook_office_path 1 IoCs
Processes:
sug11.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook sug11.exe -
outlook_win_path 1 IoCs
Processes:
sug11.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook sug11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sug11.exe"C:\Users\Admin\AppData\Local\Temp\sug11.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sug11.exe"C:\Users\Admin\AppData\Local\Temp\sug11.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-54-0x0000000000B90000-0x0000000000C1E000-memory.dmpFilesize
568KB
-
memory/1828-55-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1828-56-0x00000000041B0000-0x0000000004220000-memory.dmpFilesize
448KB
-
memory/1828-57-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/1828-58-0x0000000000450000-0x000000000045E000-memory.dmpFilesize
56KB
-
memory/1828-59-0x0000000005110000-0x0000000005172000-memory.dmpFilesize
392KB
-
memory/1828-60-0x0000000000AF0000-0x0000000000B10000-memory.dmpFilesize
128KB
-
memory/2024-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-62-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-70-0x00000000004139DE-mapping.dmp
-
memory/2024-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2024-75-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB