Analysis
-
max time kernel
236s -
max time network
283s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 18:46
Static task
static1
Behavioral task
behavioral1
Sample
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Resource
win7-20220812-en
General
-
Target
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
-
Size
747KB
-
MD5
2d9d9dc24b22cccd2ca8ca4d2975115d
-
SHA1
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab
-
SHA256
0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee
-
SHA512
45dbd9b90f8a7bf0df6b729b64d8720f49f8b28aa57a022d8b4207442bbbcf2f1a591b5223949fec8b50888fc349374d8c899b94ae8ca1c4269966590f5d3692
-
SSDEEP
12288:ehefaqG4yPaj5XwBtP3NjHetuoOqFyq6Fy2Mxzo3:geSqG4yPatXwBtP3N4qY6F0xM
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exedescription pid process target process PID 3916 set thread context of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exedescription pid process target process PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 3916 wrote to memory of 4312 3916 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3916-132-0x0000000000010000-0x00000000000D2000-memory.dmpFilesize
776KB
-
memory/3916-133-0x0000000004EE0000-0x0000000005484000-memory.dmpFilesize
5.6MB
-
memory/3916-134-0x00000000049D0000-0x0000000004A62000-memory.dmpFilesize
584KB
-
memory/3916-135-0x00000000049B0000-0x00000000049BA000-memory.dmpFilesize
40KB
-
memory/3916-136-0x0000000008800000-0x000000000889C000-memory.dmpFilesize
624KB
-
memory/4312-137-0x0000000000000000-mapping.dmp
-
memory/4312-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB