Analysis
- max time kernel
68s - max time network
119s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/07/2021, 09:45
General
- Target RFQ1220274SH0601201.exe
- Size 764KB
- Sample210713-eq3ydzeyfe
- SHA256 086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70
Malware Config
Extracted
-
lokibot
-
http://185.227.139.18/dsaicosaicasdi.php/Ooq7cQ4IpHUWj
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"C:\Users\Admin\AppData\Local\Temp\RFQ1220274SH0601201.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-114-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/648-116-0x0000000005460000-0x0000000005461000-memory.dmp
memory/648-117-0x0000000005A40000-0x0000000005A41000-memory.dmp
memory/648-118-0x00000000055E0000-0x00000000055E1000-memory.dmp
memory/648-119-0x0000000005540000-0x0000000005A3E000-memory.dmp
memory/648-120-0x0000000005440000-0x0000000005441000-memory.dmp
memory/648-121-0x0000000005740000-0x0000000005741000-memory.dmp
memory/648-122-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/648-123-0x0000000007240000-0x00000000072C7000-memory.dmp
memory/648-124-0x00000000014C0000-0x0000000001503000-memory.dmp
memory/1328-125-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1328-127-0x0000000000400000-0x00000000004A2000-memory.dmp