Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04-10-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe
Resource
win10-20220812-en
General
-
Target
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe
-
Size
1.1MB
-
MD5
32ed364f1d7cb16728c2b328f708756b
-
SHA1
9dd373e5c705bff0b0a19b96ecb4267f03beae0a
-
SHA256
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130
-
SHA512
67c5b21909fd74fa50b1d75eda60f07307bcb255c88db8a7bc968e100089776194422a90424027f594d005ef64078f519cf8148568349a6f620349300fb80517
-
SSDEEP
12288:m1s7K4HTNs2GHO4EY9z3d/FUz2GGSxls7uKoXMwOJG8H1JJfXxRy:EwG/Emz3d/ufO7HwOJGSJfhRy
Malware Config
Extracted
lokibot
http://208.67.105.161/donstan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription pid process target process PID 2336 set thread context of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exepid process 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exepid process 1920 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription pid process Token: SeDebugPrivilege 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe Token: SeDebugPrivilege 1920 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exepid process 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exepid process 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription pid process target process PID 2336 wrote to memory of 4024 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 4024 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 4024 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe PID 2336 wrote to memory of 1920 2336 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
outlook_office_path 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe -
outlook_win_path 1 IoCs
Processes:
166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"C:\Users\Admin\AppData\Local\Temp\166a7ab059b6eb18c68de7bafed0bd5203cbed1836a0e0baa3b2735410569130.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1920-189-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1920-190-0x00000000004139DE-mapping.dmp
-
memory/1920-191-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/1920-192-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/1920-231-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1920-244-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2336-151-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-124-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-121-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-153-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-123-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-154-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-125-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-126-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-127-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-128-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-129-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-130-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-131-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-132-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-133-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-134-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-135-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-136-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-137-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-138-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-139-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-140-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-141-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-142-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-143-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-144-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-145-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-146-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-147-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-148-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-149-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-150-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-119-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-152-0x0000000000C60000-0x0000000000D74000-memory.dmpFilesize
1.1MB
-
memory/2336-122-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-155-0x0000000005A70000-0x0000000005F6E000-memory.dmpFilesize
5.0MB
-
memory/2336-120-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-156-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-157-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/2336-158-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-159-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-160-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-161-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-162-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-163-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-164-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-165-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-166-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-167-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-168-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-169-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-170-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-171-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-172-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-173-0x00000000055A0000-0x00000000055AA000-memory.dmpFilesize
40KB
-
memory/2336-174-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-175-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-176-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-177-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-178-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-179-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-180-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-181-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-182-0x0000000006140000-0x000000000615C000-memory.dmpFilesize
112KB
-
memory/2336-183-0x0000000008E70000-0x0000000008E7C000-memory.dmpFilesize
48KB
-
memory/2336-118-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB
-
memory/2336-184-0x0000000009030000-0x00000000090E8000-memory.dmpFilesize
736KB
-
memory/2336-185-0x0000000009190000-0x000000000922C000-memory.dmpFilesize
624KB
-
memory/2336-186-0x0000000009230000-0x0000000009296000-memory.dmpFilesize
408KB
-
memory/2336-187-0x0000000009540000-0x00000000095A2000-memory.dmpFilesize
392KB
-
memory/2336-188-0x00000000770E0000-0x000000007726E000-memory.dmpFilesize
1.6MB