Analysis
- max time kernel
118s - max time network
149s - platform
windows10_x64 - resource
win10-en - submitted
14/09/2021, 08:27
General
- Target ESDWO909463.COM.exe
- Size 391KB
- Sample210914-kceynafcf5
- SHA256 18101c8143fc94452ed21e400ea2fa9842f516a9ceb8b61d600dfa7acb0e3e87
Malware Config
Extracted
-
lokibot
-
https://lokich.xyz/uu/koko/kosa.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"C:\Users\Admin\AppData\Local\Temp\ESDWO909463.COM.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2832-126-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2832-128-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3388-122-0x0000000008640000-0x0000000008641000-memory.dmp
memory/3388-120-0x0000000005000000-0x00000000054FE000-memory.dmp
memory/3388-121-0x0000000005480000-0x0000000005487000-memory.dmp
memory/3388-115-0x0000000000830000-0x0000000000831000-memory.dmp
memory/3388-123-0x00000000085A0000-0x00000000085F1000-memory.dmp
memory/3388-124-0x0000000006E70000-0x0000000006E8F000-memory.dmp
memory/3388-125-0x000000000DF10000-0x000000000DF11000-memory.dmp
memory/3388-119-0x0000000005250000-0x0000000005251000-memory.dmp
memory/3388-118-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/3388-117-0x0000000005500000-0x0000000005501000-memory.dmp