Overview

overview

10

Static

static

8

INVOICE.EXE

windows7_x64

10

INVOICE.EXE

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    09-07-2020 04:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INVOICE.EXE

  • Size

    388KB

  • MD5

    2ef559b1285873486f2639d6998d0ed7

  • SHA1

    c9131b6c30b9522c711537ec1c715f3c1fc3d30a

  • SHA256

    bae75dd4f9b20cf70c03927276a3b96c77f71916bead7d15477499ab1d13d499

  • SHA512

    8abef1174f7b1ff3ea58e6ea24e50bd29281ed37201b8ad559b51a27c0f3af316be4fb130b18b8fc76cf9686b3fd92e1988be51a941f77a6e4bc3ea773c018d6

Score
10/10
spywaretrojanstealerlokibot

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/ea1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Suspicious behavior: EnumeratesProcesses 1372 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE
    "C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    PID:900
    • C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE
      "C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: RenamesItself
      PID:844
    • C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE
      "C:\Users\Admin\AppData\Local\Temp\INVOICE.EXE" 2 844 66362
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/844-0-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/844-1-0x00000000004139DE-mapping.dmp
    Download
  • memory/844-2-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1332-3-0x0000000000000000-mapping.dmp
    Download