Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
b158c924678cd5bac37bfd7bfc9d8781.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b158c924678cd5bac37bfd7bfc9d8781.exe
Resource
win10v2004-20240226-en
General
-
Target
b158c924678cd5bac37bfd7bfc9d8781.exe
-
Size
1.2MB
-
MD5
b158c924678cd5bac37bfd7bfc9d8781
-
SHA1
cee45ad78360c3665af73184471b05e12a73dd5d
-
SHA256
7213e683d974ed27c90dea93b40caa5c497ca4ab9834e159adb69f7be5d2081e
-
SHA512
54cbcd44c677a305ad20d9eddead46adcbdf4aa1f132845ddc8b0d7e362c6367a98d8af606ba0cc2c896e0eec738f8d39df16cb81ef51f941378c41e8a172024
-
SSDEEP
24576:KvS/d3MKzksWks+5h9D1Rf0jNr27X7Jy8jh8N6ZN5Z:IKtxhmBK7NuN6ZN5
Malware Config
Extracted
lokibot
http://manvim.co/fd5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/4256-7-0x0000000004EA0000-0x0000000004EB2000-memory.dmp CustAttr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook b158c924678cd5bac37bfd7bfc9d8781.exe Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook b158c924678cd5bac37bfd7bfc9d8781.exe Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b158c924678cd5bac37bfd7bfc9d8781.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4256 set thread context of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3188 b158c924678cd5bac37bfd7bfc9d8781.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3188 b158c924678cd5bac37bfd7bfc9d8781.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 PID 4256 wrote to memory of 3188 4256 b158c924678cd5bac37bfd7bfc9d8781.exe 96 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook b158c924678cd5bac37bfd7bfc9d8781.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook b158c924678cd5bac37bfd7bfc9d8781.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b158c924678cd5bac37bfd7bfc9d8781.exe"C:\Users\Admin\AppData\Local\Temp\b158c924678cd5bac37bfd7bfc9d8781.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\b158c924678cd5bac37bfd7bfc9d8781.exe"C:\Users\Admin\AppData\Local\Temp\b158c924678cd5bac37bfd7bfc9d8781.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-609813121-2907144057-1731107329-1000\0f5007522459c86e95ffcc62f32308f1_0eba5ade-06df-4bb4-82bc-b49b963c83eb
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61