Analysis
- max time kernel
134s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/05/2021, 02:36
General
- Target PaymentSlip0100pdf.exe
- Size 1000KB
- Sample210524-qpbvx2vb8e
- SHA256 09f14a1a8cf75bd14aa1f480185df92f921cd241159ec4ae7bdbbfca3e52d453
Malware Config
Extracted
-
lokibot
-
http://173.208.204.37/k.php/0QZhfol01lJUV
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"C:\Users\Admin\AppData\Local\Temp\PaymentSlip0100pdf.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-142-0x0000000007FF0000-0x0000000007FF1000-memory.dmp
memory/656-131-0x0000000007020000-0x0000000007021000-memory.dmp
memory/656-163-0x0000000009000000-0x0000000009001000-memory.dmp
memory/656-158-0x0000000008CA0000-0x0000000008CA1000-memory.dmp
memory/656-151-0x0000000008CC0000-0x0000000008CF3000-memory.dmp
memory/656-143-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
memory/656-141-0x0000000007C00000-0x0000000007C01000-memory.dmp
memory/656-165-0x00000000091C0000-0x00000000091C1000-memory.dmp
memory/656-133-0x0000000001122000-0x0000000001123000-memory.dmp
memory/656-139-0x0000000007830000-0x0000000007831000-memory.dmp
memory/656-137-0x0000000007750000-0x0000000007751000-memory.dmp
memory/656-136-0x0000000006E60000-0x0000000006E61000-memory.dmp
memory/656-130-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/656-186-0x0000000001123000-0x0000000001124000-memory.dmp
memory/656-164-0x000000007F340000-0x000000007F341000-memory.dmp
memory/656-132-0x0000000001120000-0x0000000001121000-memory.dmp
memory/808-123-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/808-116-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/808-127-0x000000000B1D0000-0x000000000B1D1000-memory.dmp
memory/808-125-0x00000000080F0000-0x0000000008142000-memory.dmp
memory/808-124-0x0000000005BA0000-0x0000000005C38000-memory.dmp
memory/808-122-0x0000000004EF0000-0x0000000004EF5000-memory.dmp
memory/808-121-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/808-114-0x0000000000490000-0x0000000000491000-memory.dmp
memory/808-120-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/808-119-0x0000000004D20000-0x0000000004DBC000-memory.dmp
memory/808-118-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/808-117-0x0000000005360000-0x0000000005361000-memory.dmp
memory/3864-134-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3864-140-0x0000000000400000-0x00000000004A2000-memory.dmp