Analysis
-
max time kernel
109s -
max time network
111s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31-01-2023 02:21
Static task
static1
Behavioral task
behavioral1
Sample
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe
Resource
win10-20220812-en
General
-
Target
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe
-
Size
616KB
-
MD5
b0c4d4fbe7822e436d8dffc074375fe6
-
SHA1
2ac5c8e1e0706ebcabc41fbdaf637b61185e227d
-
SHA256
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32
-
SHA512
e1c0a35403a0f229c668e137b3cba389379ba66a93ba6ec3791dc60119af7c36d36bab538e065b8131c77471d41fac69ec322f9ef2eec4c8a97ebba3fab0c08c
-
SSDEEP
12288:MVV+Ynu0b+NoexY/9X6xaQbstgM82ks/tjLInIdZDTl+q:1Y3+NNx89XOaQbWgifOnI/Tl+
Malware Config
Extracted
lokibot
http://208.67.105.148/fresh2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription pid process target process PID 2640 set thread context of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exepid process 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exepid process 2040 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription pid process Token: SeDebugPrivilege 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe Token: SeDebugPrivilege 2040 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription pid process target process PID 2640 wrote to memory of 5064 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 5064 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 5064 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1080 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1080 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1080 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1452 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1452 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 1452 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe PID 2640 wrote to memory of 2040 2640 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
outlook_office_path 1 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe -
outlook_win_path 1 IoCs
Processes:
7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"C:\Users\Admin\AppData\Local\Temp\7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2040-185-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2040-186-0x00000000004139DE-mapping.dmp
-
memory/2040-187-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2040-188-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2040-227-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2040-240-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2640-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-118-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-119-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-152-0x0000000005230000-0x000000000572E000-memory.dmpFilesize
5.0MB
-
memory/2640-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-116-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-149-0x0000000000440000-0x00000000004E0000-memory.dmpFilesize
640KB
-
memory/2640-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-117-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-154-0x0000000004DD0000-0x0000000004E62000-memory.dmpFilesize
584KB
-
memory/2640-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-158-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-170-0x0000000004D40000-0x0000000004D4A000-memory.dmpFilesize
40KB
-
memory/2640-171-0x0000000004FD0000-0x000000000506C000-memory.dmpFilesize
624KB
-
memory/2640-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-176-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-115-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2640-180-0x0000000005200000-0x0000000005216000-memory.dmpFilesize
88KB
-
memory/2640-181-0x0000000005210000-0x000000000521A000-memory.dmpFilesize
40KB
-
memory/2640-182-0x0000000008730000-0x000000000878A000-memory.dmpFilesize
360KB
-
memory/2640-183-0x0000000008790000-0x00000000087B0000-memory.dmpFilesize
128KB
-
memory/2640-184-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB