Analysis
- max time kernel
106s - max time network
118s - platform
windows10_x64 - resource
win10v20210410 - submitted
19/08/2021, 09:09
General
- Target Weekly sailing schedules - LCL Exports.exe
- Size 1.2MB
- Sample210819-14scsnpm9e
- SHA256 e693fb2cff8b1f9cc2203552868a6c9603d33cecdc604c9c5e1fe37cd8d7d05d
Malware Config
Extracted
-
lokibot
-
http://frembonga.ga/binge/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Weekly sailing schedules - LCL Exports.exe"C:\Users\Admin\AppData\Local\Temp\Weekly sailing schedules - LCL Exports.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Weekly sailing schedules - LCL Exports.exe"C:\Users\Admin\AppData\Local\Temp\Weekly sailing schedules - LCL Exports.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4116-125-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4116-127-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4456-121-0x0000000005620000-0x0000000005B1E000-memory.dmp
memory/4456-119-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/4456-120-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/4456-114-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/4456-122-0x0000000001470000-0x0000000001481000-memory.dmp
memory/4456-123-0x0000000009B90000-0x0000000009C23000-memory.dmp
memory/4456-124-0x0000000009D80000-0x0000000009DA8000-memory.dmp
memory/4456-118-0x0000000005620000-0x0000000005621000-memory.dmp
memory/4456-117-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/4456-116-0x0000000005580000-0x0000000005581000-memory.dmp