Analysis
- max time kernel
106s - max time network
135s - platform
windows7_x64 - resource
win7v20210408 - submitted
06/09/2021, 13:49
General
- Target Document_00067876.pdf.exe
- Size 650KB
- Sample210906-q4nyjabbf8
- SHA256 6ffa78774b2d87e1401cb4e2cc783597fab1666f19f25ce0dcdced717620000f
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://semkil.xyz/ee/cc/xx.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document_00067876.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Document_00067876.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Document_00067876.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Document_00067876.pdf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/748-66-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/748-68-0x0000000074D91000-0x0000000074D93000-memory.dmp
memory/748-69-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/1120-60-0x0000000001230000-0x0000000001231000-memory.dmp
memory/1120-62-0x0000000007260000-0x0000000007261000-memory.dmp
memory/1120-63-0x0000000000500000-0x0000000000516000-memory.dmp
memory/1120-64-0x00000000011D0000-0x000000000121F000-memory.dmp
memory/1120-65-0x00000000005B0000-0x00000000005CC000-memory.dmp