Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 00:04

General

  • Target

    e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe

  • Size

    798KB

  • MD5

    b0a6d1001d3f2e90e0851497f05ef521

  • SHA1

    bea9f7d72caa5ecdaf71c6dda354298378e0d984

  • SHA256

    e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1

  • SHA512

    8fab47c798f15cb04e08d68615e7fac97fb6e3f264741e3634f9bedaeecc0649706fa1c0e657e560b3b4dfd62da14f6ea01c8e3c7444e49ba058f96d7fd5f0a0

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/qElaNgWyezEFV

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe
    "C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:508
    • C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe
      "C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe"
      2⤵
        PID:204
      • C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe
        "C:\Users\Admin\AppData\Local\Temp\e0fa6c966f07e112cf5c5e78a8d421aba10d7a05e0e3a7f352be03e0ad5389b1.exe"
        2⤵
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        PID:1836

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/508-2-0x0000000073520000-0x0000000073C0E000-memory.dmp
      Filesize

      6.9MB

    • memory/508-3-0x00000000006D0000-0x00000000006D1000-memory.dmp
      Filesize

      4KB

    • memory/508-5-0x0000000005560000-0x0000000005561000-memory.dmp
      Filesize

      4KB

    • memory/508-6-0x0000000005060000-0x0000000005061000-memory.dmp
      Filesize

      4KB

    • memory/508-7-0x0000000005100000-0x0000000005101000-memory.dmp
      Filesize

      4KB

    • memory/508-8-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
      Filesize

      4KB

    • memory/508-9-0x0000000004FD0000-0x0000000004FE2000-memory.dmp
      Filesize

      72KB

    • memory/508-10-0x0000000005BC0000-0x0000000005C17000-memory.dmp
      Filesize

      348KB

    • memory/1836-11-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB

    • memory/1836-12-0x00000000004139DE-mapping.dmp
    • memory/1836-13-0x0000000000400000-0x00000000004A2000-memory.dmp
      Filesize

      648KB