Analysis
- max time kernel
121s - max time network
121s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 17:38
General
- Target Paymentreceiptconfirmation.exe
- Size 461KB
- Sample210331-nt8z8ex2tn
- SHA256 9afbb7350fafda2e3e4e86047c929d7dc7023956ab54f073de2ba2e93d176329
Malware Config
Extracted
-
lokibot
-
http://prosperman.us/coco/coco3/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"C:\Users\Admin\AppData\Local\Temp\Paymentreceiptconfirmation.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-2-0x0000000073560000-0x0000000073C4E000-memory.dmp
memory/628-3-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/628-5-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/628-6-0x0000000005340000-0x0000000005341000-memory.dmp
memory/628-7-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/628-8-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/628-9-0x0000000005020000-0x0000000005021000-memory.dmp
memory/628-10-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/628-11-0x0000000004D50000-0x0000000004D59000-memory.dmp
memory/628-12-0x00000000059E0000-0x0000000005A28000-memory.dmp
memory/2968-13-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2968-15-0x0000000000400000-0x00000000004A2000-memory.dmp