Analysis
-
max time kernel
110s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01-02-2023 00:57
Static task
static1
Behavioral task
behavioral1
Sample
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe
Resource
win10-20220812-en
General
-
Target
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe
-
Size
722KB
-
MD5
bb7abdc1adcd9b80507f30a6236911d4
-
SHA1
9c54856199a5fd8d5d1328a01da59419aac6e46d
-
SHA256
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3
-
SHA512
6ad277dcea5117e91926d9439ae95686d409c6e0fd88eb7af5e15e723eac0f5cc5847a0ebe6eb45bf5cafe54be745ae2abc631108b20773d2b851560e7982d3d
-
SSDEEP
12288:we9acr8m2wpsCNwLI6gBYDJEP4aH9i7+pvxc4N34o:we9acr8FhC689YDOgOw6Rxc4N34
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription pid process target process PID 2424 set thread context of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exepid process 2996 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription pid process Token: SeDebugPrivilege 2996 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription pid process target process PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe PID 2424 wrote to memory of 2996 2424 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
outlook_office_path 1 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe -
outlook_win_path 1 IoCs
Processes:
73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe"C:\Users\Admin\AppData\Local\Temp\73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe"C:\Users\Admin\AppData\Local\Temp\73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2424-115-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-116-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-117-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-118-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-119-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-120-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-121-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-122-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-123-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-124-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-125-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-126-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-127-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-128-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-129-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-130-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-131-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-132-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-133-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-134-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-135-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-136-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-137-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-138-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-139-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-140-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-141-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-142-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-143-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-144-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-145-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-146-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-147-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-148-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-149-0x0000000000B40000-0x0000000000BF8000-memory.dmpFilesize
736KB
-
memory/2424-150-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-151-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-152-0x0000000005A20000-0x0000000005F1E000-memory.dmpFilesize
5.0MB
-
memory/2424-153-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-154-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/2424-155-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-156-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-157-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-158-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-159-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-160-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-161-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-162-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-163-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-164-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-165-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-166-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-167-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-168-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-169-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-170-0x0000000005430000-0x000000000543A000-memory.dmpFilesize
40KB
-
memory/2424-171-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-172-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-173-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-174-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-175-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-176-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-177-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-178-0x00000000056F0000-0x0000000005704000-memory.dmpFilesize
80KB
-
memory/2424-179-0x0000000008D10000-0x0000000008DAC000-memory.dmpFilesize
624KB
-
memory/2424-180-0x0000000005A00000-0x0000000005A0A000-memory.dmpFilesize
40KB
-
memory/2424-181-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2424-182-0x0000000008E40000-0x0000000008E9A000-memory.dmpFilesize
360KB
-
memory/2424-183-0x0000000008EA0000-0x0000000008EC2000-memory.dmpFilesize
136KB
-
memory/2996-184-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2996-186-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2996-185-0x00000000004139DE-mapping.dmp
-
memory/2996-187-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2996-188-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/2996-226-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2996-239-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB