Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-10-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe
Resource
win10-20220812-en
General
-
Target
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe
-
Size
864KB
-
MD5
4d212e3e1376174e71c8ee325d601461
-
SHA1
48f55d62e0b830e5c3bafea256b5cecd8b0a7a5a
-
SHA256
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb
-
SHA512
7c1802a294aa3b5f92995c933eeb9187b9cf2ee6583242f6abe9001ba68323b6e285be1bb8a4ce22f0f8c295aa98f385ad899608ccd885df6a8515a23253cac3
-
SSDEEP
12288:tHUezRNIaw8Vt56IwVpe8skPylGpeIPieqVdWQ+5jdefH2fTxu4ve:248ctoIlkPylAPPAn+5jdasxu4ve
Malware Config
Extracted
lokibot
http://208.67.105.162/smart/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription pid process target process PID 3516 set thread context of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exepid process 3772 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription pid process Token: SeDebugPrivilege 3772 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription pid process target process PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe PID 3516 wrote to memory of 3772 3516 f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
outlook_office_path 1 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe -
outlook_win_path 1 IoCs
Processes:
f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe"C:\Users\Admin\AppData\Local\Temp\f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe"C:\Users\Admin\AppData\Local\Temp\f695be10d46729f7034a02e8b7f4a34bfbb36ba8f5293efa74174d7b1e681bdb.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-131-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-139-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-140-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-141-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-142-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-143-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-144-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-146-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-147-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-148-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-149-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-150-0x0000000000EB0000-0x0000000000F88000-memory.dmpFilesize
864KB
-
memory/3516-151-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-152-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-153-0x0000000005C70000-0x000000000616E000-memory.dmpFilesize
5.0MB
-
memory/3516-154-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-155-0x0000000005810000-0x00000000058A2000-memory.dmpFilesize
584KB
-
memory/3516-156-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-157-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-158-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-159-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-160-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-161-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-162-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-163-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-164-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-165-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-166-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-167-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-168-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-169-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-170-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-171-0x00000000057C0000-0x00000000057CA000-memory.dmpFilesize
40KB
-
memory/3516-172-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-173-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-174-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-175-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-177-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-176-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-178-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-179-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-180-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-181-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-182-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-183-0x0000000008CE0000-0x0000000008CFC000-memory.dmpFilesize
112KB
-
memory/3516-184-0x0000000009080000-0x000000000908C000-memory.dmpFilesize
48KB
-
memory/3516-185-0x00000000091C0000-0x000000000923A000-memory.dmpFilesize
488KB
-
memory/3516-186-0x0000000009310000-0x00000000093AC000-memory.dmpFilesize
624KB
-
memory/3516-187-0x0000000009420000-0x0000000009486000-memory.dmpFilesize
408KB
-
memory/3516-188-0x00000000092B0000-0x00000000092D2000-memory.dmpFilesize
136KB
-
memory/3772-189-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3772-190-0x00000000004139DE-mapping.dmp
-
memory/3772-231-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3772-244-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB