Analysis
- max time kernel
102s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/07/2021, 01:06
General
- Target iZdmfQkBlqMmmbz.exe
- Size 536KB
- Sample210728-8ttep8ctan
- SHA256 cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
Malware Config
Extracted
-
lokibot
-
https://luoslasco.xyz/to/ya/vd.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\iZdmfQkBlqMmmbz.exe"C:\Users\Admin\AppData\Local\Temp\iZdmfQkBlqMmmbz.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iZdmfQkBlqMmmbz.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp
memory/664-116-0x0000000005890000-0x0000000005891000-memory.dmp
memory/664-117-0x0000000005270000-0x0000000005271000-memory.dmp
memory/664-118-0x0000000005390000-0x000000000588E000-memory.dmp
memory/664-119-0x0000000005250000-0x0000000005251000-memory.dmp
memory/664-120-0x00000000054C0000-0x00000000054C2000-memory.dmp
memory/664-121-0x0000000008900000-0x0000000008901000-memory.dmp
memory/664-122-0x0000000006F30000-0x0000000006F9B000-memory.dmp
memory/664-123-0x0000000006E80000-0x0000000006EA2000-memory.dmp
memory/1308-124-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1308-126-0x0000000000400000-0x00000000004A2000-memory.dmp