Analysis
- max time kernel
135s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/02/2021, 12:57
General
- Target SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe
- Size 871KB
- Sample210217-jwfrbra5gn
- SHA256 e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d
Malware Config
Extracted
-
lokibot
-
http://transcorpoil.com/dumbo/dumbo4/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.30868.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/732-3-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/732-5-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/732-6-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/732-7-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/732-8-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/732-9-0x0000000005030000-0x0000000005031000-memory.dmp
memory/732-10-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/732-11-0x00000000052F0000-0x00000000052F4000-memory.dmp
memory/732-12-0x0000000000DD0000-0x0000000000E17000-memory.dmp
memory/3580-13-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3580-15-0x0000000000400000-0x00000000004A2000-memory.dmp