Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 10:58
Static task
static1
Behavioral task
behavioral1
Sample
40ea3a0c428397cc2feb2675cc37150c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
40ea3a0c428397cc2feb2675cc37150c.exe
Resource
win10v2004-20220812-en
General
-
Target
40ea3a0c428397cc2feb2675cc37150c.exe
-
Size
705KB
-
MD5
40ea3a0c428397cc2feb2675cc37150c
-
SHA1
8b1a787ff8c044e5503139ceef1b68d68cff1f89
-
SHA256
99e69a797b5bc14f55127bc7100aabb37683008fd89043a116c83f5255a1e6d1
-
SHA512
ca903e627047cd8321acebfdd0f1227dd59e6e42361897936b05d2ba443d15c0176f3360d4cd47eb395947a932dcfc642a48ccc877b2eb0fc6b400123e5e9b3b
-
SSDEEP
12288:QpkNPA7cXnyXx6q16ahRZ5G1MQZAbRIgY5NiTisiS8fHXYvlC:pA71NMS5G1MQZAbRI35ATisizHXY
Malware Config
Extracted
lokibot
http://171.22.30.147/line/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 40ea3a0c428397cc2feb2675cc37150c.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 40ea3a0c428397cc2feb2675cc37150c.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 40ea3a0c428397cc2feb2675cc37150c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exedescription pid process target process PID 1476 set thread context of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exepid process 1476 40ea3a0c428397cc2feb2675cc37150c.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exepid process 2012 40ea3a0c428397cc2feb2675cc37150c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exe40ea3a0c428397cc2feb2675cc37150c.exedescription pid process Token: SeDebugPrivilege 1476 40ea3a0c428397cc2feb2675cc37150c.exe Token: SeDebugPrivilege 2012 40ea3a0c428397cc2feb2675cc37150c.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exedescription pid process target process PID 1476 wrote to memory of 1980 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 1980 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 1980 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 1980 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe PID 1476 wrote to memory of 2012 1476 40ea3a0c428397cc2feb2675cc37150c.exe 40ea3a0c428397cc2feb2675cc37150c.exe -
outlook_office_path 1 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 40ea3a0c428397cc2feb2675cc37150c.exe -
outlook_win_path 1 IoCs
Processes:
40ea3a0c428397cc2feb2675cc37150c.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 40ea3a0c428397cc2feb2675cc37150c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"C:\Users\Admin\AppData\Local\Temp\40ea3a0c428397cc2feb2675cc37150c.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1476-54-0x0000000000B80000-0x0000000000C36000-memory.dmpFilesize
728KB
-
memory/1476-55-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1476-56-0x0000000000380000-0x0000000000394000-memory.dmpFilesize
80KB
-
memory/1476-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1476-58-0x0000000005CE0000-0x0000000005D5C000-memory.dmpFilesize
496KB
-
memory/1476-59-0x0000000000B20000-0x0000000000B42000-memory.dmpFilesize
136KB
-
memory/2012-60-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-61-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-66-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-65-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-69-0x00000000004139DE-mapping.dmp
-
memory/2012-71-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2012-74-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB