Analysis
- max time kernel
136s - max time network
138s - platform
windows7_x64 - resource
win7-en - submitted
14/09/2021, 08:27
General
- Target ESDWO909463.COM.exe
- Size 391KB
- Sample210914-kceynafcf5
- SHA256 18101c8143fc94452ed21e400ea2fa9842f516a9ceb8b61d600dfa7acb0e3e87
Malware Config
Extracted
-
lokibot
-
https://lokich.xyz/uu/koko/kosa.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/912-59-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/912-61-0x0000000075B51000-0x0000000075B53000-memory.dmp
memory/912-62-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2036-53-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/2036-55-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/2036-56-0x00000000005F0000-0x00000000005F7000-memory.dmp
memory/2036-57-0x0000000004E20000-0x0000000004E71000-memory.dmp
memory/2036-58-0x0000000000B20000-0x0000000000B3F000-memory.dmp