Analysis
- max time kernel
108s - max time network
156s - platform
windows7_x64 - resource
win7v20210410 - submitted
02/08/2021, 06:16
General
- Target f5463dbb6131a4c2643af3700f14095b.exe
- Size 1.2MB
- Sample210802-bb7j6g1gee
- SHA256 2ef3221076c6f142a5b1bc116f74e22af2fbaf5b873f312355debf57e80291c7
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://manvim.co/fd14/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/484-65-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/484-67-0x0000000076661000-0x0000000076663000-memory.dmp
memory/484-68-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1208-59-0x0000000001220000-0x0000000001221000-memory.dmp
memory/1208-61-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/1208-62-0x0000000000300000-0x000000000030D000-memory.dmp
memory/1208-63-0x0000000009270000-0x00000000092F8000-memory.dmp
memory/1208-64-0x00000000003C0000-0x00000000003DB000-memory.dmp