Analysis
- max time kernel
112s - max time network
115s - platform
windows10_x64 - resource
win10v20210408 - submitted
11/08/2021, 07:32
General
- Target bfd2462bc77e678aaa9b8b3113f40a7d.exe
- Size 692KB
- Sample210811-4nyj7zh182
- SHA256 53a305bfa7b7d0df0e1ffd76a88a18933652fdc8bdfd389a64b5fb6a1dacb05c
Malware Config
Extracted
-
lokibot
-
http://manvim.co/fd3/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"C:\Users\Admin\AppData\Local\Temp\bfd2462bc77e678aaa9b8b3113f40a7d.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/516-114-0x0000000000100000-0x0000000000101000-memory.dmp
memory/516-116-0x0000000004980000-0x0000000004981000-memory.dmp
memory/516-117-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/516-118-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/516-119-0x0000000004AF0000-0x0000000004FEE000-memory.dmp
memory/516-120-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/516-121-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/516-122-0x0000000007030000-0x0000000007041000-memory.dmp
memory/516-123-0x00000000070F0000-0x0000000007178000-memory.dmp
memory/516-124-0x00000000097E0000-0x00000000097FC000-memory.dmp
memory/3708-125-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3708-127-0x0000000000400000-0x00000000004A2000-memory.dmp