Analysis
-
max time kernel
110s -
max time network
113s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
27-01-2023 08:31
Static task
static1
Behavioral task
behavioral1
Sample
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe
Resource
win10-20220812-en
General
-
Target
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe
-
Size
611KB
-
MD5
0c802d4ef37a0ba9232605f48d0e07b3
-
SHA1
b8b7afcd7a2f389afcac5c0c3fda472f1fe76290
-
SHA256
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54
-
SHA512
b41a109acc1b13f508f0980b068676208bd5ee92ff3b0e17044e7c0d0042ec2e1fca2ba6896461b1cf8b8e05e096718f1f7de726c425b95400396af0f8e367a7
-
SSDEEP
12288:RY/BFjCfuXdm4S4w1gzs48VUiHUqF/a82lv4b+uze+RjaXsaNCD5bAMI:CXYwAVr0y/a8mAmFra
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription pid process target process PID 2248 set thread context of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exepid process 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exepid process 1128 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription pid process Token: SeDebugPrivilege 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe Token: SeDebugPrivilege 1128 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription pid process target process PID 2248 wrote to memory of 1280 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1280 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1280 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe PID 2248 wrote to memory of 1128 2248 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
outlook_office_path 1 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe -
outlook_win_path 1 IoCs
Processes:
376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"2⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"C:\Users\Admin\AppData\Local\Temp\376b4b5c353b5bc460e6197d9bbea4728f8d5e2d3481f2fce574cedbe6b0de54.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-188-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1128-190-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1128-189-0x00000000004139DE-mapping.dmp
-
memory/1128-191-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1128-230-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1128-243-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2248-151-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-124-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-120-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-122-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-123-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-154-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-125-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-126-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-127-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-128-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-155-0x0000000005110000-0x000000000560E000-memory.dmpFilesize
5.0MB
-
memory/2248-130-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-131-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-132-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-133-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-134-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-136-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-135-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-138-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-139-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-140-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-141-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-142-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-137-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-143-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-144-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-145-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-146-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-147-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-153-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-149-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-150-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-119-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-152-0x00000000002B0000-0x0000000000350000-memory.dmpFilesize
640KB
-
memory/2248-148-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-121-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-129-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-156-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-157-0x0000000004C10000-0x0000000004CA2000-memory.dmpFilesize
584KB
-
memory/2248-158-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-159-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-160-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-161-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-162-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-163-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-165-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-164-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-166-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-167-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-168-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-169-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-170-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-171-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-172-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-173-0x0000000004B70000-0x0000000004B7A000-memory.dmpFilesize
40KB
-
memory/2248-174-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-175-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-176-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-177-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-178-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-179-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-180-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-181-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/2248-182-0x0000000008350000-0x00000000083EC000-memory.dmpFilesize
624KB
-
memory/2248-118-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-183-0x0000000004E60000-0x0000000004E6A000-memory.dmpFilesize
40KB
-
memory/2248-184-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/2248-185-0x0000000008580000-0x00000000085DA000-memory.dmpFilesize
360KB
-
memory/2248-186-0x00000000085F0000-0x0000000008612000-memory.dmpFilesize
136KB
-
memory/2248-187-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB