Analysis
-
max time kernel
42s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 23:21
Static task
static1
Behavioral task
behavioral1
Sample
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe
Resource
win10v2004-20220721-en
General
-
Target
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe
-
Size
271KB
-
MD5
6d6e6d27380ce69f043be7dc379fbf15
-
SHA1
7078801fbf3ef2523958b0431a56a07a9002d1e9
-
SHA256
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6
-
SHA512
36d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f
Malware Config
Extracted
lokibot
http://timmason2.com/demoami/demoami/iu/y/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 1772 svhost.exe -
Loads dropped DLL 2 IoCs
Processes:
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exepid process 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exedescription pid process target process PID 648 set thread context of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 624 timeout.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exepid process 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exedescription pid process Token: SeDebugPrivilege 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.execmd.execmd.exedescription pid process target process PID 648 wrote to memory of 2032 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 2032 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 2032 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 2032 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 2032 wrote to memory of 1984 2032 cmd.exe reg.exe PID 2032 wrote to memory of 1984 2032 cmd.exe reg.exe PID 2032 wrote to memory of 1984 2032 cmd.exe reg.exe PID 2032 wrote to memory of 1984 2032 cmd.exe reg.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 1772 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe svhost.exe PID 648 wrote to memory of 524 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 524 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 524 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 648 wrote to memory of 524 648 5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe cmd.exe PID 524 wrote to memory of 624 524 cmd.exe timeout.exe PID 524 wrote to memory of 624 524 cmd.exe timeout.exe PID 524 wrote to memory of 624 524 cmd.exe timeout.exe PID 524 wrote to memory of 624 524 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe"C:\Users\Admin\AppData\Local\Temp\5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.lnk" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
C:\Users\Admin\AppData\Roaming\txi7\tzt7.exeFilesize
271KB
MD56d6e6d27380ce69f043be7dc379fbf15
SHA17078801fbf3ef2523958b0431a56a07a9002d1e9
SHA2565d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6
SHA51236d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f
-
C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.batFilesize
198B
MD52e5cd464a7f51445d81d8f7b258f85e1
SHA1af8f08d277d72704eeb6b518a554bd6f5d904aea
SHA256832c62f71c5b1af187b7c48a30871af8fdb7942c95d8c172f3b92635d387b729
SHA51283dd4ad13e31c64403a4aa5b3ecc5c844a6f8ad71e5dac8b4fa8c6ad5c09277f6fac72db4258f2df84d571436f0f4d60b7a599d11bfdea32a2fbfa4b09109fba
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
\Users\Admin\AppData\Roaming\txi7\tzt7.exeFilesize
271KB
MD56d6e6d27380ce69f043be7dc379fbf15
SHA17078801fbf3ef2523958b0431a56a07a9002d1e9
SHA2565d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6
SHA51236d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f
-
memory/524-74-0x0000000000000000-mapping.dmp
-
memory/624-76-0x0000000000000000-mapping.dmp
-
memory/648-73-0x0000000074770000-0x0000000074D1B000-memory.dmpFilesize
5.7MB
-
memory/648-77-0x0000000074770000-0x0000000074D1B000-memory.dmpFilesize
5.7MB
-
memory/648-54-0x0000000075321000-0x0000000075323000-memory.dmpFilesize
8KB
-
memory/1772-63-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1772-69-0x00000000004139DE-mapping.dmp
-
memory/1772-71-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1772-66-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1772-65-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1772-61-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1772-60-0x0000000000080000-0x0000000000122000-memory.dmpFilesize
648KB
-
memory/1984-56-0x0000000000000000-mapping.dmp
-
memory/2032-55-0x0000000000000000-mapping.dmp