Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
05-07-2022 15:29
Static task
static1
Behavioral task
behavioral1
Sample
AWB & Shipping Documents.exe
Resource
win7-20220414-en
General
-
Target
AWB & Shipping Documents.exe
-
Size
532KB
-
MD5
1067d02a53935177a583c031bf612c0e
-
SHA1
19329bba794749b25f6afc08119898afd5d25b1b
-
SHA256
3f1871a081035530e1ea9e4b514e2b95d84c2454f0b84666eeec5fe77f39d43d
-
SHA512
25d7c1e1bf2f5acacb2c5a514995eb40d735205a90403469017c8b5e5b32cad5a5a6e02b58dd0be759afc1c8efb4863036419df4257aba30666d86bc9912466c
Malware Config
Extracted
lokibot
http://sempersim.su/fo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AWB & Shipping Documents.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AWB & Shipping Documents.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook AWB & Shipping Documents.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook AWB & Shipping Documents.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB & Shipping Documents.exedescription pid process target process PID 1952 set thread context of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AWB & Shipping Documents.exepid process 1952 AWB & Shipping Documents.exe 1952 AWB & Shipping Documents.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
AWB & Shipping Documents.exepid process 3104 AWB & Shipping Documents.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AWB & Shipping Documents.exeAWB & Shipping Documents.exedescription pid process Token: SeDebugPrivilege 1952 AWB & Shipping Documents.exe Token: SeDebugPrivilege 3104 AWB & Shipping Documents.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
AWB & Shipping Documents.exedescription pid process target process PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1952 wrote to memory of 3104 1952 AWB & Shipping Documents.exe AWB & Shipping Documents.exe -
outlook_office_path 1 IoCs
Processes:
AWB & Shipping Documents.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook AWB & Shipping Documents.exe -
outlook_win_path 1 IoCs
Processes:
AWB & Shipping Documents.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AWB & Shipping Documents.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-119-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-120-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-121-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-122-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-123-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-124-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-125-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-126-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-127-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-128-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-131-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-133-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-132-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-130-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-129-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-134-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-135-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-136-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-137-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-138-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-139-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-140-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-141-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-142-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-143-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-144-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-146-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-147-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-148-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-145-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-149-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-150-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-151-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-152-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-153-0x0000000000CF0000-0x0000000000D7A000-memory.dmpFilesize
552KB
-
memory/1952-155-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-154-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-156-0x0000000005B80000-0x000000000607E000-memory.dmpFilesize
5.0MB
-
memory/1952-157-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-158-0x00000000055A0000-0x0000000005632000-memory.dmpFilesize
584KB
-
memory/1952-160-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-159-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-161-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-162-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-164-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-165-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-166-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-167-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-163-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-168-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-169-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-170-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-171-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-172-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-174-0x0000000005660000-0x000000000566A000-memory.dmpFilesize
40KB
-
memory/1952-173-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-175-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-176-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-177-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-179-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-182-0x0000000005820000-0x0000000005840000-memory.dmpFilesize
128KB
-
memory/1952-181-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-180-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-178-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-183-0x0000000008E30000-0x0000000008E3E000-memory.dmpFilesize
56KB
-
memory/1952-184-0x0000000008E40000-0x0000000008E8B000-memory.dmpFilesize
300KB
-
memory/1952-185-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-186-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1952-187-0x00000000090E0000-0x0000000009144000-memory.dmpFilesize
400KB
-
memory/1952-188-0x00000000091F0000-0x000000000928C000-memory.dmpFilesize
624KB
-
memory/1952-189-0x0000000009400000-0x0000000009466000-memory.dmpFilesize
408KB
-
memory/1952-190-0x0000000009390000-0x00000000093B0000-memory.dmpFilesize
128KB
-
memory/3104-191-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3104-192-0x00000000004139DE-mapping.dmp
-
memory/3104-193-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3104-194-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3104-233-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3104-247-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB