Analysis
- max time kernel
138s - max time network
138s - platform
windows10_x64 - resource
win10 - submitted
27/10/2020, 16:45
General
- Target AWB - INVOICE AND SHIPPING DOCUMENTS .exe
- Size 843KB
- Sample201027-ap7vx8wc2a
- SHA256 3268f1c7fa17a732fee543ec75d3cfb6bf55354e751a25394bf2e980ec10e65b
Malware Config
Extracted
-
lokibot
-
http://chameloensc.com/hm/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB - INVOICE AND SHIPPING DOCUMENTS .exe"C:\Users\Admin\AppData\Local\Temp\AWB - INVOICE AND SHIPPING DOCUMENTS .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AWB - INVOICE AND SHIPPING DOCUMENTS .exe"C:\Users\Admin\AppData\Local\Temp\AWB - INVOICE AND SHIPPING DOCUMENTS .exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-12-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2704-14-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3980-7-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/3980-5-0x0000000005200000-0x0000000005201000-memory.dmp
memory/3980-6-0x0000000005140000-0x0000000005141000-memory.dmp
memory/3980-0-0x00000000730F0000-0x00000000737DE000-memory.dmp
memory/3980-8-0x0000000005B60000-0x0000000005B61000-memory.dmp
memory/3980-9-0x00000000051D0000-0x00000000051DB000-memory.dmp
memory/3980-10-0x00000000061F0000-0x0000000006241000-memory.dmp
memory/3980-11-0x0000000006030000-0x000000000604D000-memory.dmp
memory/3980-4-0x0000000005660000-0x0000000005661000-memory.dmp
memory/3980-3-0x0000000005060000-0x0000000005061000-memory.dmp
memory/3980-1-0x0000000000680000-0x0000000000681000-memory.dmp