Overview

overview

10

Static

static

Pirkimouž...�a.exe

windows7-x64

10

Pirkimouž...�a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    115s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-01-2023 12:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Pirkimoužsakymas(P.O4024282)UAB Alauša.exe

  • Size

    2.4MB

  • MD5

    7a6e0d42129b3465d6405318de62a75d

  • SHA1

    27cdcd92398cd72c27b0e78890191a00e2d8b4a4

  • SHA256

    4339ebf2887db03e86b83f7108b649e724fd71795ab6dc47a4eb268a78d6809c

  • SHA512

    020c5834c52bf38d99f7fca1d911d84b4ceec164633d6c3e9fc222de075d9c621b58dd54436403127578ff464b29712b6ac97dee8c7cf9ed200080e55c6249cc

  • SSDEEP

    49152:rcE5eDLx9XZ1fbEn18u1HCc07g+Orf2BO0YZ/dV3TgFK:4eefnvfqQgrj0YR3Tg

Score
10/10
lokibotpurecryptercollectiondownloaderloaderspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://efvsx.ga/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Detect PureCrypter injector 1 IoCs
    loader
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pirkimoužsakymas(P.O4024282)UAB Alauša.exe
    "C:\Users\Admin\AppData\Local\Temp\Pirkimoužsakymas(P.O4024282)UAB Alauša.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA0AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Users\Admin\AppData\Local\Temp\Pirkimoužsakymas(P.O4024282)UAB Alauša.exe
      "C:\Users\Admin\AppData\Local\Temp\Pirkimoužsakymas(P.O4024282)UAB Alauša.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1488-58-0x0000000000000000-mapping.dmp
    Download
  • memory/1488-62-0x000000006F460000-0x000000006FA0B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1488-61-0x000000006F460000-0x000000006FA0B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1488-60-0x000000006F460000-0x000000006FA0B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1764-70-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-72-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-78-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-77-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-75-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-64-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-65-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-67-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1764-73-0x00000000004139DE-mapping.dmp
    Download
  • memory/1764-69-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1992-57-0x0000000074F01000-0x0000000074F03000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1992-54-0x00000000012C0000-0x0000000001532000-memory.dmp
    Filesize

    2.4MB

    Download
  • memory/1992-63-0x0000000001210000-0x000000000125C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/1992-55-0x0000000000380000-0x0000000000388000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1992-56-0x0000000004EF0000-0x000000000514C000-memory.dmp
    Filesize

    2.4MB

    Download