Analysis
- max time kernel
116s - max time network
127s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 06:16
General
- Target f5463dbb6131a4c2643af3700f14095b.exe
- Size 1.2MB
- Sample210802-bb7j6g1gee
- SHA256 2ef3221076c6f142a5b1bc116f74e22af2fbaf5b873f312355debf57e80291c7
Malware Config
Extracted
-
lokibot
-
http://manvim.co/fd14/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"C:\Users\Admin\AppData\Local\Temp\f5463dbb6131a4c2643af3700f14095b.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp
memory/664-116-0x0000000005660000-0x0000000005661000-memory.dmp
memory/664-117-0x0000000005200000-0x0000000005201000-memory.dmp
memory/664-118-0x0000000005160000-0x000000000565E000-memory.dmp
memory/664-119-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/664-120-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/664-121-0x0000000001300000-0x000000000130D000-memory.dmp
memory/664-122-0x0000000009EE0000-0x0000000009F68000-memory.dmp
memory/664-123-0x0000000006C60000-0x0000000006C7B000-memory.dmp
memory/784-124-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/784-126-0x0000000000400000-0x00000000004A2000-memory.dmp