Analysis
- max time kernel
55s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
21/06/2021, 06:52
General
- Target BtLe7XbewiWhuoD.exe
- Size 658KB
- Sample210621-dmgrgahtt2
- SHA256 8a91e2138a9a4052ae32d94ea0a88a0fab4028ed233bdcb6ff8d079882ad6e62
Malware Config
Extracted
-
lokibot
-
http://63.141.228.141/32.php/8400chmGujESe
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BtLe7XbewiWhuoD.exe"C:\Users\Admin\AppData\Local\Temp\BtLe7XbewiWhuoD.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BtLe7XbewiWhuoD.exe"C:\Users\Admin\AppData\Local\Temp\BtLe7XbewiWhuoD.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-114-0x0000000000050000-0x0000000000051000-memory.dmp
memory/584-116-0x0000000004980000-0x0000000004981000-memory.dmp
memory/584-117-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/584-118-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/584-119-0x0000000004AA0000-0x0000000004F9E000-memory.dmp
memory/584-120-0x0000000004900000-0x0000000004901000-memory.dmp
memory/584-121-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/584-122-0x0000000004C00000-0x0000000004C10000-memory.dmp
memory/584-123-0x0000000006F30000-0x0000000006F99000-memory.dmp
memory/584-124-0x0000000006900000-0x0000000006930000-memory.dmp
memory/3356-125-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3356-127-0x0000000000400000-0x00000000004A2000-memory.dmp