Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 21:00
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFER.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
TRANSFER.exe
Resource
win10v2004-20221111-en
General
-
Target
TRANSFER.exe
-
Size
512KB
-
MD5
1086aab81143886e9f560384829f7c6f
-
SHA1
d9855483093d9a6ed8844c490fb6718437bcbc3f
-
SHA256
66c8806ba383d1c3671492bff679e2ee9e5f4d384b5a317a44ff45c4410a1e86
-
SHA512
e11fba1774658df4b824ad83224f8ba347cfcbd2d1108ea2be23c5fc820ce02ff2c9de1d1d919174d85d00dce56c5205be1c4813fe964645cc3641dfe7133ddd
-
SSDEEP
12288:OHOSiPb+HT0qE8S6S7ztLHKNu+A+/1bkYbupzTY0tKGIfpBGrQk2SP8D:Oub8vOztLHKNu+A+/1b9bupzrd8GrQkY
Malware Config
Extracted
lokibot
https://sempersim.su/ha7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
TRANSFER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TRANSFER.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TRANSFER.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook TRANSFER.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TRANSFER.exedescription pid process target process PID 4744 set thread context of 2744 4744 TRANSFER.exe TRANSFER.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
TRANSFER.exepid process 4744 TRANSFER.exe 4744 TRANSFER.exe 4744 TRANSFER.exe 4744 TRANSFER.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
TRANSFER.exepid process 2744 TRANSFER.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TRANSFER.exeTRANSFER.exedescription pid process Token: SeDebugPrivilege 4744 TRANSFER.exe Token: SeDebugPrivilege 2744 TRANSFER.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
TRANSFER.exedescription pid process target process PID 4744 wrote to memory of 1720 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 1720 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 1720 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 3272 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 3272 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 3272 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe PID 4744 wrote to memory of 2744 4744 TRANSFER.exe TRANSFER.exe -
outlook_office_path 1 IoCs
Processes:
TRANSFER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TRANSFER.exe -
outlook_win_path 1 IoCs
Processes:
TRANSFER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TRANSFER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-137-0x0000000000000000-mapping.dmp
-
memory/2744-139-0x0000000000000000-mapping.dmp
-
memory/2744-140-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2744-142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2744-143-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2744-144-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3272-138-0x0000000000000000-mapping.dmp
-
memory/4744-132-0x0000000000E10000-0x0000000000E96000-memory.dmpFilesize
536KB
-
memory/4744-133-0x0000000005E80000-0x0000000006424000-memory.dmpFilesize
5.6MB
-
memory/4744-134-0x00000000058D0000-0x0000000005962000-memory.dmpFilesize
584KB
-
memory/4744-135-0x0000000005830000-0x000000000583A000-memory.dmpFilesize
40KB
-
memory/4744-136-0x0000000008550000-0x00000000085EC000-memory.dmpFilesize
624KB