Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 02:56
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice16007618765.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
Payment Advice16007618765.exe
Resource
win10v2004-20240412-en
General
-
Target
Payment Advice16007618765.exe
-
Size
590KB
-
MD5
742b63d93401a9af88183725ee503df3
-
SHA1
ecfb96a3f57aee691a1c80a750518f39a8cbc474
-
SHA256
5ffa345944786c7b505a3b1b3392560b1b987529c49e11893642c8be816aa313
-
SHA512
713a629070a15990f1eaa70368bfa891ab3b736060c129ef689ecc8fd3bc5119de7379e71e272cf05d1fa50c73a68edb92a316a0507ee759e91d939d7b4af9b1
-
SSDEEP
12288:tGL21ILq9J2cWjoIa8JnjoQ/huW2YxUlbODcOYNSddW4Jf5CoXkR:ML21ILq9JrAa8RjDwLYxN4NGNfS
Malware Config
Extracted
lokibot
http://24.199.107.111/index.php/0672554332862
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Payment Advice16007618765.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Payment Advice16007618765.exe Key opened \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Payment Advice16007618765.exe Key opened \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Payment Advice16007618765.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Advice16007618765.exedescription pid process target process PID 2188 set thread context of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Payment Advice16007618765.exepid process 3036 Payment Advice16007618765.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Advice16007618765.exedescription pid process Token: SeDebugPrivilege 3036 Payment Advice16007618765.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Payment Advice16007618765.exedescription pid process target process PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe PID 2188 wrote to memory of 3036 2188 Payment Advice16007618765.exe Payment Advice16007618765.exe -
outlook_office_path 1 IoCs
Processes:
Payment Advice16007618765.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Payment Advice16007618765.exe -
outlook_win_path 1 IoCs
Processes:
Payment Advice16007618765.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Payment Advice16007618765.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice16007618765.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice16007618765.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice16007618765.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice16007618765.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2610426812-2871295383-373749122-1000\0f5007522459c86e95ffcc62f32308f1_48674c58-8cfd-4d65-8b7c-e55c67722e1bFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2610426812-2871295383-373749122-1000\0f5007522459c86e95ffcc62f32308f1_48674c58-8cfd-4d65-8b7c-e55c67722e1bFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
memory/2188-21-0x0000000074CA0000-0x000000007538E000-memory.dmpFilesize
6.9MB
-
memory/2188-0-0x00000000002E0000-0x0000000000376000-memory.dmpFilesize
600KB
-
memory/2188-4-0x00000000004D0000-0x00000000004DE000-memory.dmpFilesize
56KB
-
memory/2188-5-0x0000000000730000-0x0000000000744000-memory.dmpFilesize
80KB
-
memory/2188-6-0x000000000A060000-0x000000000A0C2000-memory.dmpFilesize
392KB
-
memory/2188-3-0x00000000009D0000-0x00000000009E8000-memory.dmpFilesize
96KB
-
memory/2188-1-0x0000000074CA0000-0x000000007538E000-memory.dmpFilesize
6.9MB
-
memory/2188-2-0x00000000004E0000-0x0000000000520000-memory.dmpFilesize
256KB
-
memory/3036-7-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-15-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3036-18-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-20-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-22-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-41-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3036-50-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB