Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
SWU5109523I.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SWU5109523I.exe
Resource
win10v2004-20240508-en
General
-
Target
SWU5109523I.exe
-
Size
1.8MB
-
MD5
1af02455b4d35d282469dde4144cbd07
-
SHA1
bcd8d182b9d8036ce3b31c4fac14cb1d074e45ff
-
SHA256
2407da1627f35dafc162c06c93c95d612ac0349488241d297152e41d0f8af7a0
-
SHA512
9ab046b3c20985290f155e07441ea97ac84bc064b8f237b2883cb65280bcf9f0b174924e8e20eb22be5b10693b20be02bdaa3ab4f9e9e79c71ded6f031af8c0a
-
SSDEEP
49152:mOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZdIrRo2ht1K1YvkUw:rv85
Malware Config
Extracted
lokibot
http://sssteell-com.pro/kedu/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4272-0-0x0000000000400000-0x00000000004A2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4272-0-0x0000000000400000-0x00000000004A2000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4272-0-0x0000000000400000-0x00000000004A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook iexplore.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook iexplore.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SWU5109523I.exedescription pid process target process PID 4480 set thread context of 4272 4480 SWU5109523I.exe iexplore.exe -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 2796 regedit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 4272 iexplore.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
SWU5109523I.exedescription pid process target process PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 2796 4480 SWU5109523I.exe regedit.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe PID 4480 wrote to memory of 4272 4480 SWU5109523I.exe iexplore.exe -
outlook_office_path 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook iexplore.exe -
outlook_win_path 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWU5109523I.exe"C:\Users\Admin\AppData\Local\Temp\SWU5109523I.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cbFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cbFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
memory/4272-0-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB