Analysis
- max time kernel
152s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 02:05
General
- Target PO#24-RFX-018RMH426.exe
- Size 973KB
- Sample210824-1aymx6a4ex
- SHA256 ae4e01b2d1998acf3b1c00515d860f5569c26d81bc3f6db56f75a7025da86c25
Malware Config
Extracted
-
lokibot
-
http://apponline354.ir/msn/Panel/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#24-RFX-018RMH426.exe"C:\Users\Admin\AppData\Local\Temp\PO#24-RFX-018RMH426.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-123-0x0000000007130000-0x0000000007131000-memory.dmp
memory/804-124-0x00000000070C0000-0x00000000070C1000-memory.dmp
memory/804-119-0x0000000006310000-0x0000000006311000-memory.dmp
memory/804-120-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/804-121-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/804-122-0x0000000007010000-0x0000000007031000-memory.dmp
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp
memory/804-118-0x0000000005410000-0x0000000005411000-memory.dmp
memory/804-125-0x0000000005DD1000-0x0000000005DD2000-memory.dmp
memory/804-126-0x0000000007560000-0x000000000756B000-memory.dmp
memory/804-127-0x0000000007570000-0x0000000007571000-memory.dmp
memory/804-116-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/804-117-0x0000000005370000-0x0000000005371000-memory.dmp
memory/4044-131-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4044-128-0x0000000000400000-0x00000000004A2000-memory.dmp