Analysis
-
max time kernel
65s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 06:16
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry Order.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Inquiry Order.exe
Resource
win10v2004-20220812-en
General
-
Target
Inquiry Order.exe
-
Size
824KB
-
MD5
2330fdee646708298e2339323ddb367b
-
SHA1
1347f5999d92f9fdb2a598d7b9c604d84174c617
-
SHA256
6107d46d911270a0dff4638eb37be034995cf887f633b24a254ce2f642564fbf
-
SHA512
476cddb75cadb570fb0685ac68515ea501afc495afd90dcc0d15719ba9287c2c1f78b965450e00bf5dd4c0c8456571469d98484df9e4239275952c614376c93c
-
SSDEEP
12288:OJrR541elNwZvodPeH2mGiPPIkaXfTwhIrht6kKwemZ:ON41eBhw2mGiPwdoPweU
Malware Config
Extracted
lokibot
http://162.0.223.13/?08fequikdahgueq78uc
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Inquiry Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Inquiry Order.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Inquiry Order.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Inquiry Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Inquiry Order.exedescription pid process target process PID 1884 set thread context of 2000 1884 Inquiry Order.exe Inquiry Order.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Inquiry Order.exepid process 2000 Inquiry Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Inquiry Order.exedescription pid process Token: SeDebugPrivilege 2000 Inquiry Order.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Inquiry Order.exedescription pid process target process PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe PID 1884 wrote to memory of 2000 1884 Inquiry Order.exe Inquiry Order.exe -
outlook_office_path 1 IoCs
Processes:
Inquiry Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Inquiry Order.exe -
outlook_win_path 1 IoCs
Processes:
Inquiry Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Inquiry Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/1884-55-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB
-
memory/1884-56-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB
-
memory/1884-70-0x00000000740E0000-0x000000007468B000-memory.dmpFilesize
5.7MB
-
memory/2000-62-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-58-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-66-0x00000000004139DE-mapping.dmp
-
memory/2000-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-57-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB