Analysis
-
max time kernel
123s -
max time network
127s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
06-07-2022 01:42
Static task
static1
General
-
Target
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe
-
Size
546KB
-
MD5
55cd077e34718e6dd5321ba23c2b0ce0
-
SHA1
4f3eaf328eacbb6b624fc8db2e0ceb87aebf980e
-
SHA256
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca
-
SHA512
84fc76e8f1e072a32dd7abe414439513d515b9ee20c0ad235ad2fe28629bdf66164ddf913ed0641f9dbc834f8dde5b01bb0f19656d014ca8719ca19d32d9b96e
Malware Config
Extracted
lokibot
http://37.0.11.227/rostov1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://�����������Ѝ������Й���Й��я��
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe Key opened \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe Key opened \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription pid process target process PID 2708 set thread context of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exepid process 1756 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription pid process Token: SeDebugPrivilege 1756 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription pid process target process PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe PID 2708 wrote to memory of 1756 2708 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
outlook_office_path 1 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe -
outlook_win_path 1 IoCs
Processes:
51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe"C:\Users\Admin\AppData\Local\Temp\51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe"C:\Users\Admin\AppData\Local\Temp\51646be768aa2ba3c5b919593f31171f32a247f08e164987bd4a4479d97454ca.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1756-190-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1756-191-0x00000000004139DE-mapping.dmp
-
memory/1756-192-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/1756-193-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/1756-232-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1756-245-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2708-151-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-124-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-121-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-122-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-153-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-154-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-125-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-126-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-127-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-128-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-129-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-131-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-130-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-132-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-133-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-134-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-135-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-136-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-137-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-138-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-139-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-140-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-141-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-142-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-143-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-144-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-145-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-146-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-147-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-148-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-149-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-150-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-119-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-152-0x0000000000640000-0x00000000006D0000-memory.dmpFilesize
576KB
-
memory/2708-155-0x0000000005420000-0x000000000591E000-memory.dmpFilesize
5.0MB
-
memory/2708-120-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-123-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-156-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-157-0x0000000004F20000-0x0000000004FB2000-memory.dmpFilesize
584KB
-
memory/2708-158-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-159-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-160-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-161-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-162-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-163-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-164-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-165-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-166-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-167-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-168-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-169-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-170-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-171-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-172-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-173-0x0000000004EE0000-0x0000000004EEA000-memory.dmpFilesize
40KB
-
memory/2708-174-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-175-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-176-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-177-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-178-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-179-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-180-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-181-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-182-0x00000000050C0000-0x00000000050E0000-memory.dmpFilesize
128KB
-
memory/2708-183-0x0000000005250000-0x000000000525E000-memory.dmpFilesize
56KB
-
memory/2708-184-0x00000000086C0000-0x000000000870B000-memory.dmpFilesize
300KB
-
memory/2708-118-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-185-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2708-186-0x0000000008930000-0x0000000008998000-memory.dmpFilesize
416KB
-
memory/2708-187-0x0000000008A40000-0x0000000008ADC000-memory.dmpFilesize
624KB
-
memory/2708-188-0x0000000008B50000-0x0000000008BB6000-memory.dmpFilesize
408KB
-
memory/2708-189-0x00000000089E0000-0x0000000008A00000-memory.dmpFilesize
128KB