Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 04:00
Static task
static1
Behavioral task
behavioral1
Sample
46A05.CO.exe
Resource
win7-20220414-en
General
-
Target
46A05.CO.exe
-
Size
533KB
-
MD5
5f7378a03aa70ca7f2da90fa87fd85e9
-
SHA1
25eb0c72c4eaecc342317c35880adbbb3f5eba01
-
SHA256
89f7f601216e8c0364524db378f16a0298616bd614c17088e9cc4070357e6931
-
SHA512
7536eaeeb8b0a6aa0b0040d3e05d8c3be3fa6b779922e8f50994ea69c211563e923e108caf1cd305614d03b80bffbd41e0ebcc229c3caf35a8c23e777ce8dba2
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=614956569061910
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
46A05.CO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 46A05.CO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
46A05.CO.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 46A05.CO.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 46A05.CO.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 46A05.CO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
46A05.CO.exedescription pid process target process PID 4660 set thread context of 4380 4660 46A05.CO.exe 46A05.CO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3204 powershell.exe 4492 powershell.exe 3204 powershell.exe 4492 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
46A05.CO.exepid process 4380 46A05.CO.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exe46A05.CO.exedescription pid process Token: SeDebugPrivilege 4492 powershell.exe Token: SeDebugPrivilege 3204 powershell.exe Token: SeDebugPrivilege 4380 46A05.CO.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
46A05.CO.exedescription pid process target process PID 4660 wrote to memory of 4492 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 4492 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 4492 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 3204 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 3204 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 3204 4660 46A05.CO.exe powershell.exe PID 4660 wrote to memory of 908 4660 46A05.CO.exe schtasks.exe PID 4660 wrote to memory of 908 4660 46A05.CO.exe schtasks.exe PID 4660 wrote to memory of 908 4660 46A05.CO.exe schtasks.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe PID 4660 wrote to memory of 4380 4660 46A05.CO.exe 46A05.CO.exe -
outlook_office_path 1 IoCs
Processes:
46A05.CO.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 46A05.CO.exe -
outlook_win_path 1 IoCs
Processes:
46A05.CO.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 46A05.CO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ugJaDZJWfXk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugJaDZJWfXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp65EE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a5dd910757f577f29426aabeeccd4baa
SHA1f1561b0ff82ea98e12111168cb6a23adca7d643e
SHA2560763d04662d0f0b1d0b07ba1f54b131806e5ad10ab4ecdb06107866040c1ce45
SHA512c7408e94331bc503459e15586134e32b403503314ba4d798e8c8af70f4448e6b0fe4c0368052a080e10213601077bffd2436c454603457542979916f73bb6afb
-
C:\Users\Admin\AppData\Local\Temp\tmp65EE.tmpFilesize
1KB
MD57342a697932e28c39343764b2c64977e
SHA153288fbe9f9391d2879bc427d5689bea8d004477
SHA2568516280528fb2cb72480fbb420779fad18f6219c868c20f04c6d2dacea628af6
SHA512eec20fe2bc96d52058c3285f5d67ccc96de803669061c529f3dfa47fedc08f3d8630e65628f04631d640c3c38d5815c96881c5695ca21c0000a931b671d206f5
-
memory/908-139-0x0000000000000000-mapping.dmp
-
memory/3204-158-0x00000000072C0000-0x00000000072CE000-memory.dmpFilesize
56KB
-
memory/3204-157-0x0000000007310000-0x00000000073A6000-memory.dmpFilesize
600KB
-
memory/3204-156-0x0000000007100000-0x000000000710A000-memory.dmpFilesize
40KB
-
memory/3204-151-0x0000000071540000-0x000000007158C000-memory.dmpFilesize
304KB
-
memory/3204-138-0x0000000000000000-mapping.dmp
-
memory/4380-147-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4380-144-0x0000000000000000-mapping.dmp
-
memory/4380-161-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4380-148-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4380-145-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4492-152-0x0000000071540000-0x000000007158C000-memory.dmpFilesize
304KB
-
memory/4492-154-0x0000000007B50000-0x00000000081CA000-memory.dmpFilesize
6.5MB
-
memory/4492-137-0x0000000002910000-0x0000000002946000-memory.dmpFilesize
216KB
-
memory/4492-142-0x0000000005230000-0x0000000005252000-memory.dmpFilesize
136KB
-
memory/4492-149-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/4492-150-0x0000000006810000-0x0000000006842000-memory.dmpFilesize
200KB
-
memory/4492-140-0x00000000055F0000-0x0000000005C18000-memory.dmpFilesize
6.2MB
-
memory/4492-136-0x0000000000000000-mapping.dmp
-
memory/4492-153-0x00000000067D0000-0x00000000067EE000-memory.dmpFilesize
120KB
-
memory/4492-143-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/4492-155-0x0000000007510000-0x000000000752A000-memory.dmpFilesize
104KB
-
memory/4492-160-0x0000000007830000-0x0000000007838000-memory.dmpFilesize
32KB
-
memory/4492-159-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/4660-133-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/4660-134-0x0000000008E70000-0x0000000008F0C000-memory.dmpFilesize
624KB
-
memory/4660-135-0x00000000090A0000-0x0000000009106000-memory.dmpFilesize
408KB
-
memory/4660-130-0x0000000000680000-0x000000000070A000-memory.dmpFilesize
552KB
-
memory/4660-132-0x00000000050B0000-0x0000000005142000-memory.dmpFilesize
584KB
-
memory/4660-131-0x0000000005660000-0x0000000005C04000-memory.dmpFilesize
5.6MB