Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-02-2023 12:17
Static task
static1
Behavioral task
behavioral1
Sample
6fca1ec5c5fff1a2d116dfad2dd9dd17.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6fca1ec5c5fff1a2d116dfad2dd9dd17.exe
Resource
win10v2004-20220812-en
General
-
Target
6fca1ec5c5fff1a2d116dfad2dd9dd17.exe
-
Size
816KB
-
MD5
6fca1ec5c5fff1a2d116dfad2dd9dd17
-
SHA1
1f54dc9048fba6cb81d0062bd86180c11325c849
-
SHA256
f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e
-
SHA512
440cff302c29474d8493fde0a10beda289ab3f02de327e2396b68caa92244cfca6c8427f0cae419891ab527c8f7dc77aba7ab4f99f7a353ec6fd3368df6e517b
-
SSDEEP
24576:Sx9p9Hl6pqW9gE+lLHv46F0xMpqG4yPafD:I9HOLOE+dHvdWiqL
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription pid process target process PID 1644 set thread context of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exepid process 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exepid process 1240 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exe6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription pid process Token: SeDebugPrivilege 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe Token: SeDebugPrivilege 1240 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription pid process target process PID 1644 wrote to memory of 840 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 840 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 840 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 840 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe PID 1644 wrote to memory of 1240 1644 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
outlook_office_path 1 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe -
outlook_win_path 1 IoCs
Processes:
6fca1ec5c5fff1a2d116dfad2dd9dd17.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 6fca1ec5c5fff1a2d116dfad2dd9dd17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"C:\Users\Admin\AppData\Local\Temp\6fca1ec5c5fff1a2d116dfad2dd9dd17.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-69-0x00000000004139DE-mapping.dmp
-
memory/1240-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1240-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1644-58-0x0000000005F70000-0x0000000005FE2000-memory.dmpFilesize
456KB
-
memory/1644-55-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1644-54-0x00000000000C0000-0x0000000000192000-memory.dmpFilesize
840KB
-
memory/1644-59-0x0000000004150000-0x000000000418A000-memory.dmpFilesize
232KB
-
memory/1644-57-0x0000000000510000-0x000000000051A000-memory.dmpFilesize
40KB
-
memory/1644-56-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB