Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 13:02
General
-
Target
MT2020101400000000000000000000000000000000000000.exe
-
Size
38.0MB
-
MD5
af4e14dc0a0735b10083f49271955abe
-
SHA1
a1f05b2bffe0421e2f6b2481ce7368116d5ceb90
-
SHA256
09d8ccb0c15957c273c7c7dfdc4c520b80eeec8b5e6956178aafa43e6f694e39
-
SHA512
2430dd17e0de00a0a962fe9a06d40cc7448fe8bd653845b1e71557f3f0743c3f624cd4f1347a4e5e3eea35bd2cc1b46fb55b3321ef272541bcaeb57265669c20
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://becharnise.ir/fox/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MT2020101400000000000000000000000000000000000000.exe"C:\Users\Admin\AppData\Local\Temp\MT2020101400000000000000000000000000000000000000.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MT2020101400000000000000000000000000000000000000.exe"C:\Users\Admin\AppData\Local\Temp\MT2020101400000000000000000000000000000000000000.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
352KB
-
Filesize
648KB
-
-
Filesize
648KB