Analysis
- max time kernel
141s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:07
General
- Target 890a21d1eba66b2b95fe8af206522643bdb42cc2c8098f1ae0d0ffe3158985c9.exe
- Size 1014KB
- Sample201110-1xe5fc68hs
- SHA256 890a21d1eba66b2b95fe8af206522643bdb42cc2c8098f1ae0d0ffe3158985c9
Malware Config
Extracted
-
lokibot
-
http://oziltestfw.ml/officem10/logs/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\890a21d1eba66b2b95fe8af206522643bdb42cc2c8098f1ae0d0ffe3158985c9.exe"C:\Users\Admin\AppData\Local\Temp\890a21d1eba66b2b95fe8af206522643bdb42cc2c8098f1ae0d0ffe3158985c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\890a21d1eba66b2b95fe8af206522643bdb42cc2c8098f1ae0d0ffe3158985c9.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3108-10-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3108-12-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4068-0-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/4068-1-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/4068-3-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/4068-4-0x0000000005920000-0x0000000005921000-memory.dmp
memory/4068-5-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/4068-6-0x0000000009250000-0x0000000009251000-memory.dmp
memory/4068-7-0x0000000007940000-0x0000000007956000-memory.dmp
memory/4068-8-0x0000000009780000-0x000000000981D000-memory.dmp
memory/4068-9-0x00000000099C0000-0x00000000099C1000-memory.dmp