Analysis
-
max time kernel
182s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 21:53
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20221111-en
General
-
Target
tmp.exe
-
Size
809KB
-
MD5
6869cfe45924c3bd855993a465c5fb6b
-
SHA1
2da76b407581d0d69762eba2ea83c850c3d0de62
-
SHA256
575eab2ba99c3d0a7ad715b2ffeb83f76ce022c4d653564b088540223b23cd00
-
SHA512
34f82691bcca485d9b72a4c98249b2f4b2471ca891b04a40e023215d15f09cd3d8d8e1f8dc05f5fa362d6cefcaf6d5d619206cb9fa7b60de946002536bafb64e
-
SSDEEP
24576:cttw5BlXfWE53FCSdFd0B3x51+TaPKSpiKOxIY:uw1+E53Faz1AaySc
Malware Config
Extracted
lokibot
https://sempersim.su/ha13/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook tmp.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook tmp.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 4628 set thread context of 2196 4628 tmp.exe tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 2196 tmp.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
tmp.exedescription pid process target process PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe PID 4628 wrote to memory of 2196 4628 tmp.exe tmp.exe -
outlook_office_path 1 IoCs
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook tmp.exe -
outlook_win_path 1 IoCs
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-137-0x0000000000000000-mapping.dmp
-
memory/2196-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2196-140-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2196-141-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2196-142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4628-132-0x0000000000B90000-0x0000000000C60000-memory.dmpFilesize
832KB
-
memory/4628-133-0x0000000005C00000-0x00000000061A4000-memory.dmpFilesize
5.6MB
-
memory/4628-134-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/4628-135-0x0000000005610000-0x000000000561A000-memory.dmpFilesize
40KB
-
memory/4628-136-0x0000000001340000-0x00000000013DC000-memory.dmpFilesize
624KB