Analysis
- max time kernel
109s - max time network
110s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/05/2021, 02:36
General
- Target PaymentSlip0100pdf.exe
- Size 1000KB
- Sample210524-qpbvx2vb8e
- SHA256 09f14a1a8cf75bd14aa1f480185df92f921cd241159ec4ae7bdbbfca3e52d453
Malware Config
Extracted
-
lokibot
-
http://173.208.204.37/k.php/0QZhfol01lJUV
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/540-60-0x0000000001380000-0x0000000001381000-memory.dmp
memory/540-62-0x0000000000540000-0x0000000000545000-memory.dmp
memory/540-63-0x0000000004980000-0x0000000004981000-memory.dmp
memory/540-64-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/540-65-0x0000000005160000-0x00000000051F8000-memory.dmp
memory/540-66-0x0000000000A90000-0x0000000000AE2000-memory.dmp
memory/1712-74-0x0000000002540000-0x0000000002541000-memory.dmp
memory/1712-76-0x00000000048E2000-0x00000000048E3000-memory.dmp
memory/1712-69-0x0000000001E30000-0x0000000001E31000-memory.dmp
memory/1712-70-0x0000000004920000-0x0000000004921000-memory.dmp
memory/1712-111-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/1712-68-0x0000000075A71000-0x0000000075A73000-memory.dmp
memory/1712-109-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/1712-75-0x00000000048E0000-0x00000000048E1000-memory.dmp
memory/1712-110-0x0000000006310000-0x0000000006311000-memory.dmp
memory/1712-78-0x0000000004750000-0x0000000004751000-memory.dmp
memory/1712-81-0x0000000005650000-0x0000000005651000-memory.dmp
memory/1712-86-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/1712-87-0x00000000061B0000-0x00000000061B1000-memory.dmp
memory/1712-94-0x0000000006240000-0x0000000006241000-memory.dmp
memory/1712-95-0x0000000005610000-0x0000000005611000-memory.dmp
memory/1848-77-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1848-71-0x0000000000400000-0x00000000004A2000-memory.dmp