Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 21:01
Static task
static1
Behavioral task
behavioral1
Sample
3113c2a7b30c1cb350e8950b4222b0c4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3113c2a7b30c1cb350e8950b4222b0c4.exe
Resource
win10v2004-20240412-en
General
-
Target
3113c2a7b30c1cb350e8950b4222b0c4.exe
-
Size
361KB
-
MD5
3113c2a7b30c1cb350e8950b4222b0c4
-
SHA1
2fe0c50dd095a738788693e147c0b9d883554d2c
-
SHA256
7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6
-
SHA512
4287e194b702492c3b0c960fc4a0cc1625607789e382b88276eaa9749f3ff32f38cf81da3543601cd1f9e2704366385962f421568702bb72a621cddf77aa58cd
-
SSDEEP
6144:MHM3730X5T4avIrevXJZzkhq8R8ahdMSM9C/JWJu0GTY8odnR1j3hfbJHtFy7tcQ:p3cT4Ed3YQG8SM9LJV3dnRLbJHtFy7tJ
Malware Config
Extracted
lokibot
https://tequilacofradiamx.com/minyhug/fxgsfhsdtytdjfudyjfjewrwsejyt/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process target process PID 944 set thread context of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 set thread context of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 set thread context of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 set thread context of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exe3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process Token: SeDebugPrivilege 944 3113c2a7b30c1cb350e8950b4222b0c4.exe Token: SeDebugPrivilege 2180 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process target process PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2180 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1836 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 1152 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 944 wrote to memory of 2068 944 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe -
outlook_office_path 1 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe -
outlook_win_path 1 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe"C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/944-0-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB
-
memory/944-1-0x00000000004E0000-0x0000000000520000-memory.dmpFilesize
256KB
-
memory/944-2-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB
-
memory/944-15-0x0000000074110000-0x00000000746BB000-memory.dmpFilesize
5.7MB
-
memory/1836-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1836-30-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2068-16-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2180-3-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2180-6-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2180-8-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2180-29-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB