Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 18:58
Static task
static1
Behavioral task
behavioral1
Sample
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Resource
win10v2004-20221111-en
General
-
Target
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
-
Size
747KB
-
MD5
2d9d9dc24b22cccd2ca8ca4d2975115d
-
SHA1
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab
-
SHA256
0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee
-
SHA512
45dbd9b90f8a7bf0df6b729b64d8720f49f8b28aa57a022d8b4207442bbbcf2f1a591b5223949fec8b50888fc349374d8c899b94ae8ca1c4269966590f5d3692
-
SSDEEP
12288:ehefaqG4yPaj5XwBtP3NjHetuoOqFyq6Fy2Mxzo3:geSqG4yPatXwBtP3N4qY6F0xM
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1112 set thread context of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 668 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe Token: SeDebugPrivilege 668 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1112 wrote to memory of 584 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 28 PID 1112 wrote to memory of 584 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 28 PID 1112 wrote to memory of 584 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 28 PID 1112 wrote to memory of 584 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 28 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 PID 1112 wrote to memory of 668 1112 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"2⤵PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:668
-