Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01-02-2023 13:34
Static task
static1
Behavioral task
behavioral1
Sample
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe
Resource
win10-20220812-en
General
-
Target
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe
-
Size
668KB
-
MD5
06f61b2e8dcaeb8e8a1e80611d53baa5
-
SHA1
e97262db5f421274929d9d190d9f45734737f201
-
SHA256
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9
-
SHA512
e834bf7fe272a929a9b3b93e7e0786e9ada09fc42e76049845909a140b5b94cac22174462d7af72c09b90566e0af3b81c32e18a043d7cf7d8ce4e4b22b25b9b1
-
SSDEEP
12288:ttz8L6guub02iDBd0ER+pVj4pmLoU25nntk6PUi+9xMRSR5SWqG4yPa:wLz0LDwIij4cLNItvX4yRU5JqG4yPa
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription pid process target process PID 2696 set thread context of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exepid process 2000 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription pid process Token: SeDebugPrivilege 2000 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription pid process target process PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe PID 2696 wrote to memory of 2000 2696 b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
outlook_office_path 1 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe -
outlook_win_path 1 IoCs
Processes:
b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-188-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-189-0x00000000004139DE-mapping.dmp
-
memory/2000-190-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2000-191-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2000-192-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2000-243-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2000-230-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2696-152-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-126-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-123-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-124-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-125-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-156-0x0000000005700000-0x0000000005BFE000-memory.dmpFilesize
5.0MB
-
memory/2696-127-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-128-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-129-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-157-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-131-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-132-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-133-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-134-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-135-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-136-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-137-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-138-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-139-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-140-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-141-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-142-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-143-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-144-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-145-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-146-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-147-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-148-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-149-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-150-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-151-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-121-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-153-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/2696-154-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-184-0x0000000008910000-0x000000000891A000-memory.dmpFilesize
40KB
-
memory/2696-122-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-130-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-158-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/2696-159-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-160-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-161-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-162-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-163-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-164-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-165-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-166-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-167-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-168-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-169-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-170-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-171-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-172-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-173-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-174-0x0000000005360000-0x000000000536A000-memory.dmpFilesize
40KB
-
memory/2696-175-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-176-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-177-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-178-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-179-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-180-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-181-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-182-0x0000000008670000-0x0000000008684000-memory.dmpFilesize
80KB
-
memory/2696-120-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-119-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-183-0x00000000089A0000-0x0000000008A3C000-memory.dmpFilesize
624KB
-
memory/2696-155-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-185-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-186-0x0000000008BF0000-0x0000000008C4A000-memory.dmpFilesize
360KB
-
memory/2696-187-0x0000000008C60000-0x0000000008C82000-memory.dmpFilesize
136KB