Analysis
- max time kernel
120s - max time network
120s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/05/2021, 04:16
General
- Target AWB.pdf.exe
- Size 950KB
- Sample210524-cfttmfal1s
- SHA256 d69273b03a77f48d73a63e9e77348c08d46ff973a69a84fbd8b5fee7de2198a3
Malware Config
Extracted
-
lokibot
-
http://173.208.204.37/k.php/tfqt7RifXPW3W
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB.pdf.exe"C:\Users\Admin\AppData\Local\Temp\AWB.pdf.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AWB.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\AWB.pdf.exe"C:\Users\Admin\AppData\Local\Temp\AWB.pdf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2256-127-0x000000000BD80000-0x000000000BD81000-memory.dmp
memory/2256-116-0x0000000005680000-0x0000000005681000-memory.dmp
memory/2256-117-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/2256-118-0x0000000005720000-0x0000000005721000-memory.dmp
memory/2256-119-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/2256-120-0x0000000005940000-0x0000000005941000-memory.dmp
memory/2256-121-0x0000000005810000-0x0000000005815000-memory.dmp
memory/2256-123-0x000000007F1E0000-0x000000007F1E1000-memory.dmp
memory/2256-122-0x0000000005720000-0x0000000005C1E000-memory.dmp
memory/2256-124-0x00000000062D0000-0x0000000006362000-memory.dmp
memory/2256-125-0x0000000008800000-0x0000000008852000-memory.dmp
memory/2256-114-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/2292-132-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2292-139-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3616-134-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/3616-142-0x0000000008CF0000-0x0000000008CF1000-memory.dmp
memory/3616-130-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/3616-135-0x00000000081C0000-0x00000000081C1000-memory.dmp
memory/3616-138-0x0000000007462000-0x0000000007463000-memory.dmp
memory/3616-137-0x0000000007460000-0x0000000007461000-memory.dmp
memory/3616-131-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
memory/3616-140-0x0000000008490000-0x0000000008491000-memory.dmp
memory/3616-141-0x0000000008290000-0x0000000008291000-memory.dmp
memory/3616-143-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
memory/3616-151-0x0000000009980000-0x00000000099B3000-memory.dmp
memory/3616-158-0x0000000008E80000-0x0000000008E81000-memory.dmp
memory/3616-163-0x0000000009AB0000-0x0000000009AB1000-memory.dmp
memory/3616-164-0x000000007EDC0000-0x000000007EDC1000-memory.dmp
memory/3616-165-0x0000000009E30000-0x0000000009E31000-memory.dmp
memory/3616-186-0x0000000007463000-0x0000000007464000-memory.dmp