Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 02:34
Static task
static1
Behavioral task
behavioral1
Sample
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe
Resource
win10v2004-20220721-en
General
-
Target
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe
-
Size
580KB
-
MD5
4d6a0789205bf65317eb37a2676ca96f
-
SHA1
c4226234299a9b1a5a6d6c0f2aa015d0e14e724b
-
SHA256
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6
-
SHA512
5cbe84f43860b64a3a2a97c7845bd5d2916a2bf48d5cb6482f55fb62844ed29e01801e4650aa198a6e615fd1195d08eecada2a44767da36111fe91b86cc755cb
Malware Config
Extracted
lokibot
http://fiftint.com/vag-2/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xrvb.exexrvb.exepid process 3564 xrvb.exe 4404 xrvb.exe -
Drops startup file 1 IoCs
Processes:
xrvb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gmst.vbs xrvb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
xrvb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook xrvb.exe Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook xrvb.exe Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook xrvb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
xrvb.exedescription pid process target process PID 3564 set thread context of 4404 3564 xrvb.exe xrvb.exe -
NTFS ADS 1 IoCs
Processes:
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\gmst\xrvb.exe:ZoneIdentifier c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exexrvb.exepid process 2820 c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe 2820 c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe 3564 xrvb.exe 3564 xrvb.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
xrvb.exepid process 3564 xrvb.exe 3564 xrvb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
xrvb.exedescription pid process Token: SeDebugPrivilege 4404 xrvb.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exexrvb.exedescription pid process target process PID 2820 wrote to memory of 3564 2820 c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe xrvb.exe PID 2820 wrote to memory of 3564 2820 c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe xrvb.exe PID 2820 wrote to memory of 3564 2820 c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe xrvb.exe PID 3564 wrote to memory of 4404 3564 xrvb.exe xrvb.exe PID 3564 wrote to memory of 4404 3564 xrvb.exe xrvb.exe PID 3564 wrote to memory of 4404 3564 xrvb.exe xrvb.exe -
outlook_office_path 1 IoCs
Processes:
xrvb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook xrvb.exe -
outlook_win_path 1 IoCs
Processes:
xrvb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook xrvb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe"C:\Users\Admin\AppData\Local\Temp\c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Roaming\gmst\xrvb.exe"C:\Users\Admin\AppData\Roaming\gmst\xrvb.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Roaming\gmst\xrvb.exe"C:\Users\Admin\AppData\Roaming\gmst\xrvb.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4404
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD54d6a0789205bf65317eb37a2676ca96f
SHA1c4226234299a9b1a5a6d6c0f2aa015d0e14e724b
SHA256c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6
SHA5125cbe84f43860b64a3a2a97c7845bd5d2916a2bf48d5cb6482f55fb62844ed29e01801e4650aa198a6e615fd1195d08eecada2a44767da36111fe91b86cc755cb
-
Filesize
580KB
MD54d6a0789205bf65317eb37a2676ca96f
SHA1c4226234299a9b1a5a6d6c0f2aa015d0e14e724b
SHA256c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6
SHA5125cbe84f43860b64a3a2a97c7845bd5d2916a2bf48d5cb6482f55fb62844ed29e01801e4650aa198a6e615fd1195d08eecada2a44767da36111fe91b86cc755cb
-
Filesize
580KB
MD54d6a0789205bf65317eb37a2676ca96f
SHA1c4226234299a9b1a5a6d6c0f2aa015d0e14e724b
SHA256c564c0450bd7792b93ffa8e9e238f710e2b5ce46c21de499f83ca764477fdab6
SHA5125cbe84f43860b64a3a2a97c7845bd5d2916a2bf48d5cb6482f55fb62844ed29e01801e4650aa198a6e615fd1195d08eecada2a44767da36111fe91b86cc755cb