Analysis
- max time kernel
16s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/03/2021, 08:01
General
- Target 5a4946a36347f1caa46109245b2b95c5.exe
- Size 414KB
- Sample210304-rsgaksg3cs
- SHA256 59f5a74779f56d64fa82f2632a50ad92e7d66571a6f06ab56af33bccd86f500b
Malware Config
Extracted
-
lokibot
-
http://51.195.53.221/p.php/PfwaUPFBW8mWS
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a4946a36347f1caa46109245b2b95c5.exe"C:\Users\Admin\AppData\Local\Temp\5a4946a36347f1caa46109245b2b95c5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4168-16-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4168-19-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4640-7-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/4640-10-0x0000000005DD0000-0x0000000005DF1000-memory.dmp
memory/4640-11-0x0000000005E80000-0x0000000005E81000-memory.dmp
memory/4640-12-0x0000000005DA0000-0x0000000005DA1000-memory.dmp
memory/4640-13-0x0000000004D61000-0x0000000004D62000-memory.dmp
memory/4640-14-0x0000000006520000-0x000000000652B000-memory.dmp
memory/4640-15-0x0000000008AF0000-0x0000000008AF1000-memory.dmp
memory/4640-8-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/4640-2-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/4640-6-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/4640-5-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/4640-3-0x0000000000100000-0x0000000000101000-memory.dmp