Analysis
-
max time kernel
113s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
NOO5789909.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NOO5789909.exe
Resource
win10v2004-20220812-en
General
-
Target
NOO5789909.exe
-
Size
819KB
-
MD5
869c61a9af412707d9b8a3bee00349ff
-
SHA1
99c29aab339a729a80adcc3d8510c10d384f4379
-
SHA256
db382b74819cd4431972a7fcd845aaab7c62ff55c5bcedf92af38a17be07194e
-
SHA512
d9df3d87fd7642eba3fbc9524242d7cb49a005420448135a79cedb38febcd24b5f1831bdbda3ecd544a7e7c033cbc73716972d1411f6a506868995c768570160
-
SSDEEP
12288:eOx8OH504YWyrGrsHXrKaTEeg2iYSAtynnuzR7PlniO90/tTgD5JYC+kMTlY:gkyPjEeg2iRAtynnuzRLFWtTa
Malware Config
Extracted
lokibot
http://sempersim.su/gk3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
NOO5789909.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook NOO5789909.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook NOO5789909.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook NOO5789909.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NOO5789909.exedescription pid process target process PID 3520 set thread context of 4988 3520 NOO5789909.exe NOO5789909.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
NOO5789909.exepid process 4988 NOO5789909.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NOO5789909.exedescription pid process Token: SeDebugPrivilege 4988 NOO5789909.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NOO5789909.exedescription pid process target process PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe PID 3520 wrote to memory of 4988 3520 NOO5789909.exe NOO5789909.exe -
outlook_office_path 1 IoCs
Processes:
NOO5789909.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook NOO5789909.exe -
outlook_win_path 1 IoCs
Processes:
NOO5789909.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook NOO5789909.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOO5789909.exe"C:\Users\Admin\AppData\Local\Temp\NOO5789909.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NOO5789909.exe"C:\Users\Admin\AppData\Local\Temp\NOO5789909.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3520-132-0x00000000001E0000-0x00000000002B2000-memory.dmpFilesize
840KB
-
memory/3520-133-0x0000000005260000-0x0000000005804000-memory.dmpFilesize
5.6MB
-
memory/3520-134-0x0000000004CB0000-0x0000000004D42000-memory.dmpFilesize
584KB
-
memory/3520-135-0x0000000004C50000-0x0000000004C5A000-memory.dmpFilesize
40KB
-
memory/3520-136-0x0000000007680000-0x000000000771C000-memory.dmpFilesize
624KB
-
memory/3520-137-0x0000000007720000-0x0000000007786000-memory.dmpFilesize
408KB
-
memory/4988-138-0x0000000000000000-mapping.dmp
-
memory/4988-139-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4988-141-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4988-142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4988-143-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB