Analysis
-
max time kernel
141s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 09:42
Static task
static1
Behavioral task
behavioral1
Sample
fb4f4746d44d1ae472506334dacf6956.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fb4f4746d44d1ae472506334dacf6956.exe
Resource
win10v2004-20230220-en
General
-
Target
fb4f4746d44d1ae472506334dacf6956.exe
-
Size
201KB
-
MD5
fb4f4746d44d1ae472506334dacf6956
-
SHA1
44c44fae4e3007fa8636e9108dd8070ce7ab7a07
-
SHA256
ce66d8963808e8a84fb85edd8b2850099ae240eab88f2a98413efd01e40922b1
-
SHA512
be971f9a181b5a7bd9efbe47a160a0eda5b981f871eede2aacd872a00940f082487ae1704249494bd78f5ae616e013afb11098ec89055acdd26b1a12996d3a11
-
SSDEEP
3072:HfY/TU9fE9PEtu4beIkBZHFfUqayG/s3ABV0IOFVhEpvC402Dp+bocVKtww7l7:/Ya6EefvHp17G/b/kEd0s4o2KN7l7
Malware Config
Extracted
lokibot
https://sempersim.su/ha25/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
awdaoqo.exeawdaoqo.exepid process 2040 awdaoqo.exe 1188 awdaoqo.exe -
Loads dropped DLL 3 IoCs
Processes:
fb4f4746d44d1ae472506334dacf6956.exeawdaoqo.exepid process 1132 fb4f4746d44d1ae472506334dacf6956.exe 1132 fb4f4746d44d1ae472506334dacf6956.exe 2040 awdaoqo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
awdaoqo.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook awdaoqo.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook awdaoqo.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook awdaoqo.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
awdaoqo.exedescription pid process target process PID 2040 set thread context of 1188 2040 awdaoqo.exe awdaoqo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
awdaoqo.exepid process 2040 awdaoqo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
awdaoqo.exedescription pid process Token: SeDebugPrivilege 1188 awdaoqo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fb4f4746d44d1ae472506334dacf6956.exeawdaoqo.exedescription pid process target process PID 1132 wrote to memory of 2040 1132 fb4f4746d44d1ae472506334dacf6956.exe awdaoqo.exe PID 1132 wrote to memory of 2040 1132 fb4f4746d44d1ae472506334dacf6956.exe awdaoqo.exe PID 1132 wrote to memory of 2040 1132 fb4f4746d44d1ae472506334dacf6956.exe awdaoqo.exe PID 1132 wrote to memory of 2040 1132 fb4f4746d44d1ae472506334dacf6956.exe awdaoqo.exe PID 2040 wrote to memory of 1188 2040 awdaoqo.exe awdaoqo.exe PID 2040 wrote to memory of 1188 2040 awdaoqo.exe awdaoqo.exe PID 2040 wrote to memory of 1188 2040 awdaoqo.exe awdaoqo.exe PID 2040 wrote to memory of 1188 2040 awdaoqo.exe awdaoqo.exe PID 2040 wrote to memory of 1188 2040 awdaoqo.exe awdaoqo.exe -
outlook_office_path 1 IoCs
Processes:
awdaoqo.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook awdaoqo.exe -
outlook_win_path 1 IoCs
Processes:
awdaoqo.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook awdaoqo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4f4746d44d1ae472506334dacf6956.exe"C:\Users\Admin\AppData\Local\Temp\fb4f4746d44d1ae472506334dacf6956.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe"C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe" C:\Users\Admin\AppData\Local\Temp\fgpjmasrn.o2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe"C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
C:\Users\Admin\AppData\Local\Temp\cmcehbasj.hFilesize
124KB
MD5e5938d6946b58f3cf7dd8b27b1b0f8c0
SHA1d7c96ac11d2e41835f77ef90aec4fbe69580c8d3
SHA2561c2ddbccfd5050efb38f0613d18dac11690e9c793ac881170d2b06e5118c4199
SHA5125bf347470969e077be619ab981b6924b14dce931a666b89e4dc0f0dd2935829cfc8d5de694bc7c828ec3293cc05e2435ef650f0540a1087f9bbb86b99db76f2a
-
C:\Users\Admin\AppData\Local\Temp\fgpjmasrn.oFilesize
5KB
MD54f37ca5aef7664f31c8ebaf3d4833d06
SHA151cacf7c3151948e751b955a79cec382b24f9b52
SHA25605e6e85149f3f7e3562d9bf491d35a66cdd877f3cd8778cdd0d18f7804b05135
SHA512c98d327f39e7c80412cd730a9ed19064f5bfd05279476db120fe273c5c59cd8db4d4c23e753b0b5c5fdd27de10c86c99e17e5cc315989aa943203f3ffd4fe55c
-
\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
\Users\Admin\AppData\Local\Temp\awdaoqo.exeFilesize
138KB
MD5046685d9d7d278fa6c44c733e6d0c2ac
SHA1168e23588c8f1007db38ef6e16d5fd0405d79fe7
SHA256faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456
SHA512317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474
-
memory/1188-68-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-72-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-73-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-76-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-79-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-80-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1188-81-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB