Overview
overview
10Static
static
10files/1.exe
windows7-x64
1files/1.exe
windows10-2004-x64
1files/10.exe
windows7-x64
7files/10.exe
windows10-2004-x64
7files/11.exe
windows7-x64
10files/11.exe
windows10-2004-x64
10files/12.exe
windows7-x64
8files/12.exe
windows10-2004-x64
8files/13.exe
windows7-x64
10files/13.exe
windows10-2004-x64
10files/14.exe
windows7-x64
10files/14.exe
windows10-2004-x64
10files/15.exe
windows7-x64
10files/15.exe
windows10-2004-x64
10files/2.exe
windows7-x64
10files/2.exe
windows10-2004-x64
10files/3.exe
windows7-x64
10files/3.exe
windows10-2004-x64
10files/4.exe
windows7-x64
10files/4.exe
windows10-2004-x64
10files/5.exe
windows7-x64
10files/5.exe
windows10-2004-x64
10files/6.exe
windows7-x64
6files/6.exe
windows10-2004-x64
6files/7.exe
windows7-x64
10files/7.exe
windows10-2004-x64
10files/8.exe
windows7-x64
10files/8.exe
windows10-2004-x64
10files/9.exe
windows7-x64
10files/9.exe
windows10-2004-x64
10Analysis
-
max time kernel
129s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 05:57
Behavioral task
behavioral1
Sample
files/1.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
files/1.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
files/10.exe
Resource
win7-20220715-en
Behavioral task
behavioral4
Sample
files/10.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral5
Sample
files/11.exe
Resource
win7-20220715-en
Behavioral task
behavioral6
Sample
files/11.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral7
Sample
files/12.exe
Resource
win7-20220715-en
Behavioral task
behavioral8
Sample
files/12.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral9
Sample
files/13.exe
Resource
win7-20220715-en
Behavioral task
behavioral10
Sample
files/13.exe
Resource
win10v2004-20220722-en
Behavioral task
behavioral11
Sample
files/14.exe
Resource
win7-20220715-en
Behavioral task
behavioral12
Sample
files/14.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral13
Sample
files/15.exe
Resource
win7-20220715-en
Behavioral task
behavioral14
Sample
files/15.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral15
Sample
files/2.exe
Resource
win7-20220718-en
Behavioral task
behavioral16
Sample
files/2.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral17
Sample
files/3.exe
Resource
win7-20220715-en
Behavioral task
behavioral18
Sample
files/3.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral19
Sample
files/4.exe
Resource
win7-20220718-en
Behavioral task
behavioral20
Sample
files/4.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral21
Sample
files/5.exe
Resource
win7-20220718-en
Behavioral task
behavioral22
Sample
files/5.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral23
Sample
files/6.exe
Resource
win7-20220715-en
Behavioral task
behavioral24
Sample
files/6.exe
Resource
win10v2004-20220722-en
Behavioral task
behavioral25
Sample
files/7.exe
Resource
win7-20220718-en
Behavioral task
behavioral26
Sample
files/7.exe
Resource
win10v2004-20220722-en
Behavioral task
behavioral27
Sample
files/8.exe
Resource
win7-20220718-en
Behavioral task
behavioral28
Sample
files/8.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral29
Sample
files/9.exe
Resource
win7-20220718-en
General
-
Target
files/2.exe
-
Size
632KB
-
MD5
d41280a6e0d472497a8786e84ca35eb4
-
SHA1
a064b75867d0fd14f4bd4f28aa1243ff0031f0b5
-
SHA256
e857e4a4ef4ff78fd220ba78a5bff8bd68ef7d944f24aba2276ec057a7667f31
-
SHA512
86f196b581f6b7c524e1176495d8ed8a14a5267e4df0c7b6a06173a1108c3f1635d81b9ba0313ec719156e2ff0803f5c66c3406b9adec5ec9b5f5c54c969563b
Malware Config
Extracted
lokibot
http://verificatcert.ga/evans/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 2.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2.exedescription pid process target process PID 1764 set thread context of 1288 1764 2.exe 2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2.exepid process 1288 2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2.exedescription pid process Token: SeDebugPrivilege 1288 2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2.exepid process 1764 2.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2.exedescription pid process target process PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe PID 1764 wrote to memory of 1288 1764 2.exe 2.exe -
outlook_office_path 1 IoCs
Processes:
2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 2.exe -
outlook_win_path 1 IoCs
Processes:
2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\files\2.exe"C:\Users\Admin\AppData\Local\Temp\files\2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\files\2.exe"C:\Users\Admin\AppData\Local\Temp\files\2.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-58-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1288-59-0x00000000004139DE-mapping.dmp
-
memory/1288-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1288-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1288-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1764-56-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1764-57-0x0000000000350000-0x0000000000356000-memory.dmpFilesize
24KB