Analysis
-
max time kernel
113s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 21:02
Static task
static1
Behavioral task
behavioral1
Sample
kellyzx.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
kellyzx.exe
Resource
win10v2004-20221111-en
General
-
Target
kellyzx.exe
-
Size
477KB
-
MD5
025207095ce4531ddc16d0c1dce457cb
-
SHA1
afb61d96ff8eb5974109a1fdd59559f1ca7cf6db
-
SHA256
e7ecce5580d7ffce80b2921d953d528aeb9c1f724a49d91db380478c5423c3f2
-
SHA512
b029525635baa96e1b3c969899cc92b8cd7a512dcfa3b6f180e8dbcc7f3ae48a69fee48bbd9f70ed9f2f795c10daec30f9a93fe1a39e60f09309ae4a02bda662
-
SSDEEP
12288:6r8i69LjbTQmvpuAHoZ/A/UrrWXQG4dWtb9i7+pvtCWtO:6r8i2bTDMSqrWADdObw6Rch
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
kellyzx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook kellyzx.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook kellyzx.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook kellyzx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kellyzx.exedescription pid process target process PID 1504 set thread context of 1800 1504 kellyzx.exe kellyzx.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
kellyzx.exepid process 1800 kellyzx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
kellyzx.exedescription pid process Token: SeDebugPrivilege 1800 kellyzx.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
kellyzx.exedescription pid process target process PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe PID 1504 wrote to memory of 1800 1504 kellyzx.exe kellyzx.exe -
outlook_office_path 1 IoCs
Processes:
kellyzx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook kellyzx.exe -
outlook_win_path 1 IoCs
Processes:
kellyzx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook kellyzx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kellyzx.exe"C:\Users\Admin\AppData\Local\Temp\kellyzx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kellyzx.exe"C:\Users\Admin\AppData\Local\Temp\kellyzx.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-54-0x0000000000A40000-0x0000000000ABC000-memory.dmpFilesize
496KB
-
memory/1504-55-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1504-56-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1504-57-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/1504-58-0x0000000004CD0000-0x0000000004D2A000-memory.dmpFilesize
360KB
-
memory/1504-59-0x0000000001F40000-0x0000000001F62000-memory.dmpFilesize
136KB
-
memory/1800-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-69-0x00000000004139DE-mapping.dmp
-
memory/1800-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1800-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB