Analysis
- max time kernel
100s - max time network
104s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/08/2021, 15:09
General
- Target Factura comercial.exe
- Size 573KB
- Sample210805-a17nc2n4hx
- SHA256 38fa7af4a9c0cb9102017ef9b666fa74604f6d54416575f59db506106941b85d
Malware Config
Extracted
-
lokibot
-
https://pakilogs2020.xyz/t/e/ff.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura comercial.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/652-116-0x0000000005140000-0x0000000005141000-memory.dmp
memory/652-117-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
memory/652-118-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/652-119-0x0000000004C40000-0x000000000513E000-memory.dmp
memory/652-120-0x00000000081D0000-0x00000000081D2000-memory.dmp
memory/652-121-0x0000000008280000-0x0000000008281000-memory.dmp
memory/652-122-0x0000000006820000-0x00000000068AB000-memory.dmp
memory/652-123-0x0000000006780000-0x00000000067BD000-memory.dmp
memory/1960-124-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1960-126-0x0000000000400000-0x00000000004A2000-memory.dmp