Analysis
- max time kernel
118s - max time network
120s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/06/2021, 07:45
General
- Target SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe
- Size 1.5MB
- Sample210603-ke42kv5aaa
- SHA256 5689e6baf4a5e10b19eb7dc78f65f421e964d49548fdcc6a7751acae7c14ddda
Malware Config
Extracted
-
lokibot
-
http://173.208.204.37/k.php/tfqt7RifXPW3W
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUF4F4246A4EF74.22626.10392.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1040-126-0x000000000B4D0000-0x000000000B4D1000-memory.dmp
memory/1040-116-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1040-117-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/1040-118-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1040-119-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1040-120-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/1040-121-0x0000000004DE0000-0x00000000052DE000-memory.dmp
memory/1040-122-0x0000000004D10000-0x0000000004D24000-memory.dmp
memory/1040-123-0x0000000005A80000-0x0000000005B03000-memory.dmp
memory/1040-124-0x0000000005030000-0x0000000005070000-memory.dmp
memory/1040-114-0x0000000000250000-0x0000000000251000-memory.dmp
memory/3256-138-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3256-133-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3500-139-0x00000000076E0000-0x00000000076E1000-memory.dmp
memory/3500-141-0x0000000008000000-0x0000000008001000-memory.dmp
memory/3500-131-0x0000000006990000-0x0000000006991000-memory.dmp
memory/3500-130-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
memory/3500-135-0x0000000006FA0000-0x0000000006FA1000-memory.dmp
memory/3500-136-0x0000000007600000-0x0000000007601000-memory.dmp
memory/3500-129-0x0000000004370000-0x0000000004371000-memory.dmp
memory/3500-140-0x0000000007A50000-0x0000000007A51000-memory.dmp
memory/3500-132-0x0000000006992000-0x0000000006993000-memory.dmp
memory/3500-142-0x0000000007E60000-0x0000000007E61000-memory.dmp
memory/3500-150-0x0000000008C10000-0x0000000008C43000-memory.dmp
memory/3500-157-0x0000000008BF0000-0x0000000008BF1000-memory.dmp
memory/3500-162-0x0000000008D70000-0x0000000008D71000-memory.dmp
memory/3500-163-0x000000007EBB0000-0x000000007EBB1000-memory.dmp
memory/3500-164-0x0000000009130000-0x0000000009131000-memory.dmp
memory/3500-185-0x0000000006993000-0x0000000006994000-memory.dmp