Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 20:20
Static task
static1
Behavioral task
behavioral1
Sample
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe
Resource
win10v2004-20221111-en
General
-
Target
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe
-
Size
444KB
-
MD5
61e3610e99cf93d96d79a1f3bf023a3b
-
SHA1
5ba9d8506042aa613bac7c68a263bbd037d79d0f
-
SHA256
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847
-
SHA512
be7579c4e4b5f5a96582cc2eafc8689ce6a13090b881677a9ae8ee1d24913a56604aafc438a21554ab8afffc49558e09efc41697085e521d6fae25148ea407b4
-
SSDEEP
12288:14JZcV9VV+VFpVCvVVOvt1ENcvez7206dVYHhTf0wXWRm:Ov0Nm06IHhT78m
Malware Config
Extracted
lokibot
http://3tril.com/armani/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/1460-56-0x00000000002E0000-0x00000000002E8000-memory.dmp CustAttr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription pid process target process PID 1460 set thread context of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription pid process Token: SeDebugPrivilege 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe Token: SeDebugPrivilege 1796 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription pid process target process PID 1460 wrote to memory of 1360 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe schtasks.exe PID 1460 wrote to memory of 1360 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe schtasks.exe PID 1460 wrote to memory of 1360 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe schtasks.exe PID 1460 wrote to memory of 1360 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe schtasks.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe PID 1460 wrote to memory of 1796 1460 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe -
outlook_office_path 1 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe -
outlook_win_path 1 IoCs
Processes:
861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe"C:\Users\Admin\AppData\Local\Temp\861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KDmuOzNh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp875A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe"C:\Users\Admin\AppData\Local\Temp\861660dfbd8471081a50e80eb9103ecc16f17f61352e4c9fcf4582f79e439847.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp875A.tmpFilesize
1KB
MD5817642772da6fe3f5201d95916826efb
SHA116ebb4b67b70dd7d6e27dd9ee83bd80a8d912572
SHA2567d35c065f8671699636c5ba3d67ca2feb1136c55eda23fe8000da0201234258f
SHA51222cd18afa9e79658b81f918730e8d941a7b8a92c6c13b8799d9676dedc6f51c923464e1e166c40eed3a0249dac56391771ad822e898eebf12a3557e7a98ff440
-
memory/1360-58-0x0000000000000000-mapping.dmp
-
memory/1460-54-0x0000000000FC0000-0x0000000001034000-memory.dmpFilesize
464KB
-
memory/1460-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1460-56-0x00000000002E0000-0x00000000002E8000-memory.dmpFilesize
32KB
-
memory/1460-57-0x0000000004C10000-0x0000000004C5A000-memory.dmpFilesize
296KB
-
memory/1796-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-69-0x00000000004139DE-mapping.dmp
-
memory/1796-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1796-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB