Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 12:21
Static task
static1
Behavioral task
behavioral1
Sample
TT swift advise.exe
Resource
win7-20220414-en
General
-
Target
TT swift advise.exe
-
Size
490KB
-
MD5
a9c5b90bea45b7cc178b12622e8e9740
-
SHA1
8ed7875dcfd593a1f69dd27a14eee37f16d89066
-
SHA256
a44ca269366aaf1ff566a07612899523e7b865b3af8f18a4f98918ecaba79c65
-
SHA512
90a89f3b43582691ce231ff86e75f7a05ed5d10c91a5092ba7093a82b9f4f163c668c5b86882f21b3ed76aac725e98e923dcf3d49ea4077edfa901f027cd0f7e
Malware Config
Extracted
lokibot
http://sempersim.su/gi10/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions TT swift advise.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools TT swift advise.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
TT swift advise.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion TT swift advise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion TT swift advise.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook TT swift advise.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TT swift advise.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TT swift advise.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum TT swift advise.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 TT swift advise.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TT swift advise.exedescription pid process target process PID 1216 set thread context of 1236 1216 TT swift advise.exe TT swift advise.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
TT swift advise.exepowershell.exepowershell.exepid process 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 972 powershell.exe 1580 powershell.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe 1216 TT swift advise.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
TT swift advise.exepid process 1236 TT swift advise.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
TT swift advise.exepowershell.exepowershell.exeTT swift advise.exedescription pid process Token: SeDebugPrivilege 1216 TT swift advise.exe Token: SeDebugPrivilege 972 powershell.exe Token: SeDebugPrivilege 1580 powershell.exe Token: SeDebugPrivilege 1236 TT swift advise.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
TT swift advise.exedescription pid process target process PID 1216 wrote to memory of 1580 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 1580 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 1580 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 1580 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 972 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 972 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 972 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 972 1216 TT swift advise.exe powershell.exe PID 1216 wrote to memory of 1712 1216 TT swift advise.exe schtasks.exe PID 1216 wrote to memory of 1712 1216 TT swift advise.exe schtasks.exe PID 1216 wrote to memory of 1712 1216 TT swift advise.exe schtasks.exe PID 1216 wrote to memory of 1712 1216 TT swift advise.exe schtasks.exe PID 1216 wrote to memory of 1872 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1872 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1872 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1872 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 2040 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 2040 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 2040 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 2040 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1784 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1784 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1784 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1784 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe PID 1216 wrote to memory of 1236 1216 TT swift advise.exe TT swift advise.exe -
outlook_office_path 1 IoCs
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TT swift advise.exe -
outlook_win_path 1 IoCs
Processes:
TT swift advise.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TT swift advise.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kdNepFKSI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kdNepFKSI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1537.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"C:\Users\Admin\AppData\Local\Temp\TT swift advise.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1537.tmpFilesize
1KB
MD5d8aa6ca9513db2ef55d556331a10c97e
SHA1dc611f361d2e65ec6d201ac5ee66f964aa7194be
SHA256a1faeae4a02feab5477be90ac9b699776b7d03d60bbbb717d3000b2146e94266
SHA512bcbae1cf92af455030293eb55c43ab06c06b5c6fc8c7f97452b7851f3a0ca30d98ba555248134e914af67c11f45d4a2ceb283058e19cfaa60f844e9b3ebe88c0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD52505011aee30dd9d9e45d38610b7e70e
SHA15c9d01b2c8f2e912ea9d673abaae0040b9425ef2
SHA256713935438aa9e4b8723c976d2969713c3ad5b1ced4548ff7fb193d84e2fec48f
SHA512bfa2e360a023ca915a0e870a504ff90c2f7838b69e0b14058bd15aec33c10a339df7c3f883e9d98afd4e9bb36f71065785e0d67ce7f4a37959eb98c9f9ea8423
-
memory/972-73-0x000000006EC40000-0x000000006F1EB000-memory.dmpFilesize
5.7MB
-
memory/972-83-0x000000006EC40000-0x000000006F1EB000-memory.dmpFilesize
5.7MB
-
memory/972-62-0x0000000000000000-mapping.dmp
-
memory/1216-55-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1216-56-0x0000000002000000-0x0000000002068000-memory.dmpFilesize
416KB
-
memory/1216-57-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/1216-58-0x0000000000520000-0x000000000052E000-memory.dmpFilesize
56KB
-
memory/1216-59-0x0000000005000000-0x0000000005058000-memory.dmpFilesize
352KB
-
memory/1216-54-0x0000000000050000-0x00000000000D0000-memory.dmpFilesize
512KB
-
memory/1216-67-0x0000000005070000-0x0000000005090000-memory.dmpFilesize
128KB
-
memory/1236-76-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-78-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-75-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-86-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-84-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1236-79-0x00000000004139DE-mapping.dmp
-
memory/1236-81-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1580-60-0x0000000000000000-mapping.dmp
-
memory/1580-70-0x000000006EC40000-0x000000006F1EB000-memory.dmpFilesize
5.7MB
-
memory/1580-85-0x000000006EC40000-0x000000006F1EB000-memory.dmpFilesize
5.7MB
-
memory/1712-63-0x0000000000000000-mapping.dmp