Analysis
- max time kernel
48s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/11/2020, 22:34
General
- Target vbc.exe
- Size 741KB
- Sample201103-dlhe35b266
- SHA256 9ebe51e383ea0bdd41359e085172e6555e9f7e24cae16c128f84b8def85f48ad
Malware Config
Extracted
-
lokibot
-
http://195.69.140.147/.op/cr.php/NCTxXyKTcBIUf
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3160-0-0x00000000733A0000-0x0000000073A8E000-memory.dmp
memory/3160-1-0x0000000000570000-0x0000000000571000-memory.dmp
memory/3160-3-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/3160-4-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/3160-5-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/3160-6-0x0000000005E00000-0x0000000005E01000-memory.dmp
memory/3160-7-0x0000000005190000-0x00000000051A6000-memory.dmp
memory/3160-8-0x0000000006470000-0x0000000006504000-memory.dmp
memory/3160-9-0x00000000065B0000-0x00000000065B1000-memory.dmp
memory/3576-10-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3576-12-0x0000000000400000-0x00000000004A2000-memory.dmp