Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
682f1a11681229794b6a48fe65b9e223.exe
Resource
win7-20220414-en
General
-
Target
682f1a11681229794b6a48fe65b9e223.exe
-
Size
517KB
-
MD5
682f1a11681229794b6a48fe65b9e223
-
SHA1
a35bacfea0c786cfc4a9d6c59071807520511d78
-
SHA256
1a07532785f1d0a43b0b5d68d54e411dd3f1bf1faec90deba15e2bff2df86cff
-
SHA512
d6c6a6cf38a4b1b97ae1738861d241dfaa1f972d171ccfd57ec961810b7d123cebb42f20a9e4c79c22a5d0c6f30d4c818d4059649c7efb298a08ae9f3a422435
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=12495881296063980
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 682f1a11681229794b6a48fe65b9e223.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 682f1a11681229794b6a48fe65b9e223.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 682f1a11681229794b6a48fe65b9e223.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription pid process target process PID 836 set thread context of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription pid process Token: SeDebugPrivilege 1540 682f1a11681229794b6a48fe65b9e223.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription pid process target process PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe PID 836 wrote to memory of 1540 836 682f1a11681229794b6a48fe65b9e223.exe 682f1a11681229794b6a48fe65b9e223.exe -
outlook_office_path 1 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 682f1a11681229794b6a48fe65b9e223.exe -
outlook_win_path 1 IoCs
Processes:
682f1a11681229794b6a48fe65b9e223.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 682f1a11681229794b6a48fe65b9e223.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\682f1a11681229794b6a48fe65b9e223.exe"C:\Users\Admin\AppData\Local\Temp\682f1a11681229794b6a48fe65b9e223.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\682f1a11681229794b6a48fe65b9e223.exe"C:\Users\Admin\AppData\Local\Temp\682f1a11681229794b6a48fe65b9e223.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-54-0x0000000000960000-0x00000000009E8000-memory.dmpFilesize
544KB
-
memory/836-55-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/836-56-0x00000000002D0000-0x00000000002F0000-memory.dmpFilesize
128KB
-
memory/836-57-0x00000000004C0000-0x00000000004CE000-memory.dmpFilesize
56KB
-
memory/836-58-0x00000000051E0000-0x0000000005248000-memory.dmpFilesize
416KB
-
memory/836-59-0x0000000000920000-0x0000000000940000-memory.dmpFilesize
128KB
-
memory/1540-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-69-0x00000000004139DE-mapping.dmp
-
memory/1540-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1540-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB