Overview

overview

10

Static

static

Proof_of_P...2.xlsx

windows7_x64

10

Proof_of_P...2.xlsx

windows10_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proof_of_Payment_2020112.xlsx

  • Size

    2.0MB

  • Sample

    210122-3f7xf51pga

  • MD5

    153d89ab5de4c8d7283531e179bc4db0

  • SHA1

    ab2948d1dfae6c4a29241dd5c4abe261b5dd0c20

  • SHA256

    f4033e5baff349334f140f3560640157f8753543576b64e8254f0523c28d1051

  • SHA512

    eec417abf49cb12ebb340046d1b1394dd8d0ea4ed49c29b50131de4444a3f99b86dbf99fe87f382541a9eb724f1ea97a0cf5d3cfd738de13c81444718fe8d6c6

Score
10/10
lokibotransomwarespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Proof_of_Payment_2020112.xlsx

    • Size

      2.0MB

    • MD5

      153d89ab5de4c8d7283531e179bc4db0

    • SHA1

      ab2948d1dfae6c4a29241dd5c4abe261b5dd0c20

    • SHA256

      f4033e5baff349334f140f3560640157f8753543576b64e8254f0523c28d1051

    • SHA512

      eec417abf49cb12ebb340046d1b1394dd8d0ea4ed49c29b50131de4444a3f99b86dbf99fe87f382541a9eb724f1ea97a0cf5d3cfd738de13c81444718fe8d6c6

    Score
    10/10
    lokibotransomwarespywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks