Analysis
- max time kernel
104s - max time network
107s - platform
windows10_x64 - resource
win10v200722 - submitted
18/08/2020, 08:49
General
- Target PO #20200817.exe
- Size 1.1MB
- Sample200818-7tfbwblg72
- SHA256 41a9e893d9922e09870fcb8a968be26b7645c491b655b11b59be8c284c1e1b29
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://rarlab.gq/comic/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO #20200817.exe"C:\Users\Admin\AppData\Local\Temp\PO #20200817.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ardcgxb.exe"C:\Users\Admin\AppData\Local\Temp\Ardcgxb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1008-4-0x0000000002970000-0x0000000002980000-memory.dmp
memory/1008-6-0x0000000004540000-0x000000000458E000-memory.dmp
memory/3828-7-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3828-9-0x0000000000400000-0x00000000004A2000-memory.dmp