Analysis
-
max time kernel
53s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
UNAM463MX5694.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
UNAM463MX5694.exe
Resource
win10v2004-20220812-en
General
-
Target
UNAM463MX5694.exe
-
Size
864KB
-
MD5
7d138abf1c52a9a83c10beb3a280c97a
-
SHA1
b4faddfefe4a1505c7b98390a91860316358774b
-
SHA256
74e53af9391a576f9ab4cc6182f51514946d4e7c41db02ea8927c6f5bb0ca54d
-
SHA512
bebf48963263650851c349d0c2e81fac315b432caec478718d2ee43e12bff9e477f8211a589484de9c12a0d2bba5d319a5ec986d03661f312bc2b2221cb61564
-
SSDEEP
12288:3JUc2iNPR/4veraoKvYfcVBEjR5rlHB1Xm+P7RYNKnpRrjySYuYy6Oof:3H1v4verLKwfcQ9/H3vkKpRyf
Malware Config
Extracted
lokibot
http://162.0.223.13/?08fequikdahgueq78uc
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
UNAM463MX5694.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook UNAM463MX5694.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook UNAM463MX5694.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook UNAM463MX5694.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
UNAM463MX5694.exedescription pid process target process PID 3848 set thread context of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
UNAM463MX5694.exepid process 1484 UNAM463MX5694.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
UNAM463MX5694.exedescription pid process Token: SeDebugPrivilege 1484 UNAM463MX5694.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
UNAM463MX5694.exedescription pid process target process PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe PID 3848 wrote to memory of 1484 3848 UNAM463MX5694.exe UNAM463MX5694.exe -
outlook_office_path 1 IoCs
Processes:
UNAM463MX5694.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook UNAM463MX5694.exe -
outlook_win_path 1 IoCs
Processes:
UNAM463MX5694.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook UNAM463MX5694.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UNAM463MX5694.exe"C:\Users\Admin\AppData\Local\Temp\UNAM463MX5694.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UNAM463MX5694.exe"C:\Users\Admin\AppData\Local\Temp\UNAM463MX5694.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1484-138-0x0000000000000000-mapping.dmp
-
memory/1484-139-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1484-141-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1484-142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1484-143-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3848-132-0x0000000000E90000-0x0000000000F6E000-memory.dmpFilesize
888KB
-
memory/3848-133-0x0000000005E10000-0x00000000063B4000-memory.dmpFilesize
5.6MB
-
memory/3848-134-0x0000000005900000-0x0000000005992000-memory.dmpFilesize
584KB
-
memory/3848-135-0x0000000005A90000-0x0000000005A9A000-memory.dmpFilesize
40KB
-
memory/3848-136-0x0000000009260000-0x00000000092FC000-memory.dmpFilesize
624KB
-
memory/3848-137-0x0000000009370000-0x00000000093D6000-memory.dmpFilesize
408KB