Analysis
- max time kernel
45s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/03/2021, 07:29
General
- Target WNIOSEK O OFERTĘ 03-03-2021-pdf.exe
- Size 648KB
- Sample210303-k82wh9cbza
- SHA256 2c151e8a462558e66b1cfd1a84fc7348d145bc4d5e0456bacc423743a30a7390
Malware Config
Extracted
-
lokibot
-
http://51.195.53.221/p.php/pXqVbj1ory8MD
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WNIOSEK O OFERTĘ 03-03-2021-pdf.exe"C:\Users\Admin\AppData\Local\Temp\WNIOSEK O OFERTĘ 03-03-2021-pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cookies.exe"C:\Users\Admin\AppData\Local\Temp\cookies.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1144-12-0x0000000006360000-0x0000000006361000-memory.dmp
memory/1144-21-0x0000000004F31000-0x0000000004F32000-memory.dmp
memory/1144-6-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/1144-7-0x0000000005040000-0x0000000005041000-memory.dmp
memory/1144-8-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/1144-10-0x0000000006390000-0x00000000063B1000-memory.dmp
memory/1144-11-0x0000000006440000-0x0000000006441000-memory.dmp
memory/1144-2-0x0000000073A80000-0x000000007416E000-memory.dmp
memory/1144-5-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/1144-13-0x0000000007030000-0x0000000007031000-memory.dmp
memory/1144-3-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3220-15-0x0000000073A80000-0x000000007416E000-memory.dmp
memory/3220-22-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/3220-28-0x00000000058F1000-0x00000000058F2000-memory.dmp
memory/3220-29-0x0000000007190000-0x000000000719B000-memory.dmp
memory/3220-30-0x0000000007490000-0x0000000007491000-memory.dmp