Analysis
-
max time kernel
113s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10-01-2023 14:11
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
813KB
-
MD5
46a28f1b24c3ae50f7630f544a7a55f3
-
SHA1
8746397c083ecd786e988c3f07a4989bdf6bcc82
-
SHA256
1ca4ca83f6246b9efaa32bc030d9373f72971fb01deff6499d6664fc7ce142e4
-
SHA512
44f3955a362271767377ade33c56dd9cb22b5dc3dedd1139f06c0345e50f4ce607a01bdda1df53d62dbeba018bcbb057fba641c76d1d84c9ad7b8526b1f07a1d
-
SSDEEP
24576:ReGs5nyyxk4YJ24hdYlXRgLlqEZV/NWC3gh/Wgfz:ReGs5nyCktF38mlqEZVuh/Wgf
Malware Config
Extracted
lokibot
http://171.22.30.147/gk1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook tmp.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook tmp.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1184 set thread context of 1768 1184 tmp.exe 28 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1768 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 tmp.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 PID 1184 wrote to memory of 1768 1184 tmp.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook tmp.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1768
-