Analysis
-
max time kernel
94s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 21:01
Static task
static1
Behavioral task
behavioral1
Sample
3113c2a7b30c1cb350e8950b4222b0c4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3113c2a7b30c1cb350e8950b4222b0c4.exe
Resource
win10v2004-20240412-en
General
-
Target
3113c2a7b30c1cb350e8950b4222b0c4.exe
-
Size
361KB
-
MD5
3113c2a7b30c1cb350e8950b4222b0c4
-
SHA1
2fe0c50dd095a738788693e147c0b9d883554d2c
-
SHA256
7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6
-
SHA512
4287e194b702492c3b0c960fc4a0cc1625607789e382b88276eaa9749f3ff32f38cf81da3543601cd1f9e2704366385962f421568702bb72a621cddf77aa58cd
-
SSDEEP
6144:MHM3730X5T4avIrevXJZzkhq8R8ahdMSM9C/JWJu0GTY8odnR1j3hfbJHtFy7tcQ:p3cT4Ed3YQG8SM9LJV3dnRLbJHtFy7tJ
Malware Config
Extracted
lokibot
https://tequilacofradiamx.com/minyhug/fxgsfhsdtytdjfudyjfjewrwsejyt/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process target process PID 2388 set thread context of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 set thread context of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 set thread context of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 set thread context of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 216 4008 WerFault.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe 1936 1836 WerFault.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exepid process 3492 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exe3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process Token: SeDebugPrivilege 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe Token: SeDebugPrivilege 3492 3113c2a7b30c1cb350e8950b4222b0c4.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription pid process target process PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 1836 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 4008 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 3492 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe PID 2388 wrote to memory of 2524 2388 3113c2a7b30c1cb350e8950b4222b0c4.exe 3113c2a7b30c1cb350e8950b4222b0c4.exe -
outlook_office_path 1 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe -
outlook_win_path 1 IoCs
Processes:
3113c2a7b30c1cb350e8950b4222b0c4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3113c2a7b30c1cb350e8950b4222b0c4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe"C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exeC:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1836 -ip 18361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4008 -ip 40081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1836-3-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2388-0-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/2388-1-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/2388-2-0x00000000017F0000-0x0000000001800000-memory.dmpFilesize
64KB
-
memory/2388-13-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/2524-14-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3492-5-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3492-8-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3492-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3492-29-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB