Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 07:54
Static task
static1
Behavioral task
behavioral1
Sample
68894cfd6f4a1bfff344f54760726df7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68894cfd6f4a1bfff344f54760726df7.exe
Resource
win10v2004-20231215-en
General
-
Target
68894cfd6f4a1bfff344f54760726df7.exe
-
Size
431KB
-
MD5
68894cfd6f4a1bfff344f54760726df7
-
SHA1
9ae844e3abd601bf5daca1e3ebe331591388493e
-
SHA256
07c1a82c5517f92f78a830e12cb1813430c4e02e02c1b6d16cd8d632f80d92f7
-
SHA512
ecbff66abb82def82b0b51f24b0f9a58bee7f214ea83630c48ff0dd65a308e9ec54248e756948967729ecfd0d0c524a84e7230b3935cf8779160d491b6716797
-
SSDEEP
6144:T+hiQ1o1W5UoKOy2Y5Dd1yh2gReb6d0VOw8qRBGEPU49ogCvrFbtKSyISGgEJFs:ifrKOeRch2g0zVf8qRkSU4+gOxlcHwF
Malware Config
Extracted
lokibot
https://sempersim.su/c11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
68894cfd6f4a1bfff344f54760726df7.exedescription pid process target process PID 2512 set thread context of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
68894cfd6f4a1bfff344f54760726df7.exedescription pid process target process PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe PID 2512 wrote to memory of 2356 2512 68894cfd6f4a1bfff344f54760726df7.exe 68894cfd6f4a1bfff344f54760726df7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68894cfd6f4a1bfff344f54760726df7.exe"C:\Users\Admin\AppData\Local\Temp\68894cfd6f4a1bfff344f54760726df7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\68894cfd6f4a1bfff344f54760726df7.exe"C:\Users\Admin\AppData\Local\Temp\68894cfd6f4a1bfff344f54760726df7.exe"2⤵PID:2356