Analysis
-
max time kernel
114s -
max time network
116s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
05-10-2022 16:51
Static task
static1
Behavioral task
behavioral1
Sample
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe
Resource
win10-20220812-en
General
-
Target
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe
-
Size
888KB
-
MD5
8ab4ebec842d01831f9166672e9a8774
-
SHA1
de53befe37b492fb0248de5bde6f562bb23caaa4
-
SHA256
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189
-
SHA512
da35c669b1f590e6bb081286d615287357d6ab71544065b41cf8b739aaec4edada67ae4e3e8ad01ebf9e673780dae60c52980252356e2532a4f1f020e3c8bf78
-
SSDEEP
12288:AkUc2iN8R/4vev7MRICfAlzXXGasa3Vz/BencJR:A81Y4vev7MRklbbKcJR
Malware Config
Extracted
lokibot
http://208.67.105.162/smart/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription pid process target process PID 3040 set thread context of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exepid process 1128 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription pid process Token: SeDebugPrivilege 1128 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription pid process target process PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe PID 3040 wrote to memory of 1128 3040 c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
outlook_office_path 1 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe -
outlook_win_path 1 IoCs
Processes:
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe"C:\Users\Admin\AppData\Local\Temp\c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe"C:\Users\Admin\AppData\Local\Temp\c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-191-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1128-192-0x00000000004139DE-mapping.dmp
-
memory/1128-231-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1128-246-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3040-118-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-119-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-120-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-121-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-122-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-123-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-124-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-125-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-126-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-127-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-128-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-129-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-130-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-131-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-132-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-133-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-134-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-135-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-136-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-137-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-138-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-139-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-140-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-141-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-142-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-143-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-144-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-145-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-146-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-147-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-148-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-149-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-150-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-151-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-152-0x0000000000710000-0x00000000007F4000-memory.dmpFilesize
912KB
-
memory/3040-153-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-154-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-155-0x0000000005550000-0x0000000005A4E000-memory.dmpFilesize
5.0MB
-
memory/3040-156-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-157-0x0000000005050000-0x00000000050E2000-memory.dmpFilesize
584KB
-
memory/3040-158-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-159-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-160-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-161-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-162-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-163-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-164-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-165-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-166-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-167-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-168-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-169-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-170-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-171-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-172-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-173-0x0000000005030000-0x000000000503A000-memory.dmpFilesize
40KB
-
memory/3040-174-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-175-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-176-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-177-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-179-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-178-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-180-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-181-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-182-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-183-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-184-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-185-0x00000000052D0000-0x00000000052EC000-memory.dmpFilesize
112KB
-
memory/3040-186-0x00000000052F0000-0x00000000052FC000-memory.dmpFilesize
48KB
-
memory/3040-187-0x0000000008A40000-0x0000000008ABA000-memory.dmpFilesize
488KB
-
memory/3040-188-0x0000000008B80000-0x0000000008C1C000-memory.dmpFilesize
624KB
-
memory/3040-189-0x0000000008C20000-0x0000000008C86000-memory.dmpFilesize
408KB
-
memory/3040-190-0x0000000008B20000-0x0000000008B40000-memory.dmpFilesize
128KB