Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 03:18
Static task
static1
Behavioral task
behavioral1
Sample
f9ef1fe311686cb5fe268707df8bd971.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f9ef1fe311686cb5fe268707df8bd971.exe
Resource
win10v2004-20220812-en
General
-
Target
f9ef1fe311686cb5fe268707df8bd971.exe
-
Size
615KB
-
MD5
f9ef1fe311686cb5fe268707df8bd971
-
SHA1
7a9fcdbb9e8c9f95a4fd5cefa00078eb2503bf14
-
SHA256
825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d
-
SHA512
86f492767d31e0dac0f3bc4d503c71766420e819f2d9e701454ee6002a3edfbb9c313b5742c0188c48d2a18c627cd2a61de89a5a50410f8dc9a07c96b69191a3
-
SSDEEP
12288:sqNXsnu0b+NoexY/PrMERjU/u0pNQ5JGJNnuPG9TlT:rs3+NNx8PI/uSG5JG7nuu9Tl
Malware Config
Extracted
lokibot
http://171.22.30.164/zang/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f9ef1fe311686cb5fe268707df8bd971.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook f9ef1fe311686cb5fe268707df8bd971.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f9ef1fe311686cb5fe268707df8bd971.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exedescription pid process target process PID 2036 set thread context of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exepid process 2036 f9ef1fe311686cb5fe268707df8bd971.exe 2036 f9ef1fe311686cb5fe268707df8bd971.exe 2036 f9ef1fe311686cb5fe268707df8bd971.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exepid process 1520 f9ef1fe311686cb5fe268707df8bd971.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exef9ef1fe311686cb5fe268707df8bd971.exedescription pid process Token: SeDebugPrivilege 2036 f9ef1fe311686cb5fe268707df8bd971.exe Token: SeDebugPrivilege 1520 f9ef1fe311686cb5fe268707df8bd971.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exedescription pid process target process PID 2036 wrote to memory of 1604 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1604 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1604 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1604 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1596 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1596 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1596 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1596 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1688 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1688 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1688 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1688 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe PID 2036 wrote to memory of 1520 2036 f9ef1fe311686cb5fe268707df8bd971.exe f9ef1fe311686cb5fe268707df8bd971.exe -
outlook_office_path 1 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook f9ef1fe311686cb5fe268707df8bd971.exe -
outlook_win_path 1 IoCs
Processes:
f9ef1fe311686cb5fe268707df8bd971.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook f9ef1fe311686cb5fe268707df8bd971.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"C:\Users\Admin\AppData\Local\Temp\f9ef1fe311686cb5fe268707df8bd971.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-69-0x00000000004139DE-mapping.dmp
-
memory/1520-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1520-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2036-58-0x0000000004F20000-0x0000000004F7A000-memory.dmpFilesize
360KB
-
memory/2036-55-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/2036-54-0x00000000001D0000-0x0000000000270000-memory.dmpFilesize
640KB
-
memory/2036-59-0x0000000000A20000-0x0000000000A40000-memory.dmpFilesize
128KB
-
memory/2036-57-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/2036-56-0x00000000003D0000-0x00000000003E6000-memory.dmpFilesize
88KB