Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 05:35
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Tedy.154569.19490.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.Variant.Tedy.154569.19490.exe
-
Size
580KB
-
MD5
155d1e5ad55adc2d9da5abcbc9db15cf
-
SHA1
c222dd086a332c8c4e21a1ebb6f07013592c5af4
-
SHA256
1d1288c2ce2893c49f8b5415034de067a2d68ccddc08fe89f8711e568d777505
-
SHA512
22c4769aae9f3489c8e4a947c89aecb7182a80c426028432a18eb8e42f6c2b07ac947f4a3347475530b127f96cc85bffa216a3aa3865733ad3f557588b59182f
Malware Config
Extracted
lokibot
http://s509040.smrtp.ru/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SecuriteInfo.com.Variant.Tedy.154569.19490.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook SecuriteInfo.com.Variant.Tedy.154569.19490.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exedescription pid process target process PID 328 set thread context of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exepowershell.exepid process 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe 2024 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exepid process 896 SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exepowershell.exeSecuriteInfo.com.Variant.Tedy.154569.19490.exedescription pid process Token: SeDebugPrivilege 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeDebugPrivilege 896 SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exedescription pid process target process PID 328 wrote to memory of 2024 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe powershell.exe PID 328 wrote to memory of 2024 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe powershell.exe PID 328 wrote to memory of 2024 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe powershell.exe PID 328 wrote to memory of 2024 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe powershell.exe PID 328 wrote to memory of 1268 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe schtasks.exe PID 328 wrote to memory of 1268 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe schtasks.exe PID 328 wrote to memory of 1268 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe schtasks.exe PID 328 wrote to memory of 1268 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe schtasks.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe PID 328 wrote to memory of 896 328 SecuriteInfo.com.Variant.Tedy.154569.19490.exe SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
outlook_office_path 1 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook SecuriteInfo.com.Variant.Tedy.154569.19490.exe -
outlook_win_path 1 IoCs
Processes:
SecuriteInfo.com.Variant.Tedy.154569.19490.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SecuriteInfo.com.Variant.Tedy.154569.19490.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.154569.19490.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.154569.19490.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RRjPkSVSuiBTbf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RRjPkSVSuiBTbf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDDE2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.154569.19490.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.154569.19490.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDDE2.tmpFilesize
1KB
MD5c961b7699d95dbf298d52539744068d0
SHA12a88bc2d35d65186f6abdc7c56a3dfe55793b4e6
SHA256a08797f2541e69acae746e4dd9db172d803b7d2bfa56653d55dcc314b6d9d0f4
SHA5128be726b814de72b45f66e85d07ae8a0a056473766ae9c9b280be117d572397c63b6eb7a9b1114667eeafbb6371328b74002781b9ad9a127091b990d763012703
-
memory/328-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/328-56-0x0000000000650000-0x0000000000670000-memory.dmpFilesize
128KB
-
memory/328-57-0x00000000008C0000-0x00000000008CE000-memory.dmpFilesize
56KB
-
memory/328-58-0x0000000005AC0000-0x0000000005B22000-memory.dmpFilesize
392KB
-
memory/328-54-0x00000000008D0000-0x0000000000966000-memory.dmpFilesize
600KB
-
memory/328-63-0x0000000005BE0000-0x0000000005C00000-memory.dmpFilesize
128KB
-
memory/896-73-0x00000000004139DE-mapping.dmp
-
memory/896-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-69-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-70-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-80-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-78-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/896-75-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1268-60-0x0000000000000000-mapping.dmp
-
memory/2024-77-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB
-
memory/2024-59-0x0000000000000000-mapping.dmp
-
memory/2024-79-0x000000006E2F0000-0x000000006E89B000-memory.dmpFilesize
5.7MB