Analysis
- max time kernel
97s - max time network
143s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/05/2021, 23:01
General
- Target IMG-WA7905432.exe
- Size 116KB
- Sample210503-effyz4v1ej
- SHA256 96beaff70c51e04f38db0943eddd24ecc142ef2815d536b82655e25fbf5a54db
Malware Config
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG-WA7905432.exe"C:\Users\Admin\AppData\Local\Temp\IMG-WA7905432.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG-WA7905432.exe"C:\Users\Admin\AppData\Local\Temp\IMG-WA7905432.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/808-116-0x00000000022E0000-0x00000000022EC000-memory.dmp
memory/1388-118-0x0000000000400000-0x0000000000553000-memory.dmp
memory/1388-119-0x0000000000401000-0x00000000004FD000-memory.dmp
memory/1388-120-0x0000000000560000-0x0000000000660000-memory.dmp
memory/1388-121-0x0000000000413000-0x0000000000414000-memory.dmp
memory/1388-123-0x0000000000403000-0x0000000000404000-memory.dmp
memory/1388-122-0x0000000000408000-0x0000000000409000-memory.dmp
memory/1388-125-0x0000000000405000-0x0000000000406000-memory.dmp
memory/1388-124-0x0000000000402000-0x0000000000403000-memory.dmp
memory/1388-126-0x0000000000414000-0x0000000000415000-memory.dmp
memory/1388-128-0x0000000000406000-0x0000000000407000-memory.dmp
memory/1388-127-0x0000000000404000-0x0000000000405000-memory.dmp
memory/1388-129-0x0000000000412000-0x0000000000413000-memory.dmp
memory/1388-130-0x0000000000409000-0x000000000040A000-memory.dmp
memory/1388-131-0x000000000040C000-0x000000000040D000-memory.dmp
memory/1388-132-0x0000000000407000-0x0000000000408000-memory.dmp
memory/1388-133-0x000000000040D000-0x000000000040E000-memory.dmp
memory/1388-135-0x000000000040F000-0x0000000000410000-memory.dmp
memory/1388-134-0x0000000000410000-0x0000000000411000-memory.dmp
memory/1388-136-0x000000000040E000-0x000000000040F000-memory.dmp
memory/1388-137-0x0000000000411000-0x0000000000412000-memory.dmp
memory/1388-139-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/1388-138-0x0000000000401000-0x0000000000402000-memory.dmp
memory/1388-159-0x00000000004A0000-0x00000000004A1000-memory.dmp