Analysis
-
max time kernel
220s -
max time network
265s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 19:03
Static task
static1
Behavioral task
behavioral1
Sample
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Resource
win7-20221111-en
General
-
Target
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
-
Size
747KB
-
MD5
2d9d9dc24b22cccd2ca8ca4d2975115d
-
SHA1
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab
-
SHA256
0b31e3396946781f4215290726981f96511ebc2d286a56d911e102ee7145c6ee
-
SHA512
45dbd9b90f8a7bf0df6b729b64d8720f49f8b28aa57a022d8b4207442bbbcf2f1a591b5223949fec8b50888fc349374d8c899b94ae8ca1c4269966590f5d3692
-
SSDEEP
12288:ehefaqG4yPaj5XwBtP3NjHetuoOqFyq6Fy2Mxzo3:geSqG4yPatXwBtP3N4qY6F0xM
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exedescription pid process target process PID 4556 set thread context of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exedescription pid process target process PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe PID 4556 wrote to memory of 4728 4556 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe 1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"C:\Users\Admin\AppData\Local\Temp\1fc2da1c1c87af9637bfb4858fee4037cd5e60ab.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4556-132-0x0000000000840000-0x0000000000902000-memory.dmpFilesize
776KB
-
memory/4556-133-0x00000000059A0000-0x0000000005F44000-memory.dmpFilesize
5.6MB
-
memory/4556-134-0x00000000052E0000-0x0000000005372000-memory.dmpFilesize
584KB
-
memory/4556-135-0x00000000053C0000-0x00000000053CA000-memory.dmpFilesize
40KB
-
memory/4556-136-0x0000000001200000-0x000000000129C000-memory.dmpFilesize
624KB
-
memory/4728-137-0x0000000000000000-mapping.dmp
-
memory/4728-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4728-140-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4728-141-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB