Analysis
- max time kernel
144s - max time network
146s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
06/10/2021, 15:37
General
- Target 2961221_.EXE
- Size 331KB
- Sample211006-s2fv9abehl
- SHA256 77bababe2b59fa4b44fdd6ec2706128fccb7856e6dd89adb9be11e123f6fa521
Malware Config
Extracted
-
lokibot
-
http://vs5p2ck.ga/stalker/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2961221_.EXE"C:\Users\Admin\AppData\Local\Temp\2961221_.EXE"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2961221_.EXE"C:\Users\Admin\AppData\Local\Temp\2961221_.EXE"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2384-115-0x0000000000530000-0x0000000000531000-memory.dmp
memory/2384-117-0x0000000005560000-0x0000000005561000-memory.dmp
memory/2384-118-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/2384-119-0x0000000005060000-0x000000000555E000-memory.dmp
memory/2384-120-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/2384-121-0x0000000007390000-0x0000000007391000-memory.dmp
memory/2384-122-0x0000000005150000-0x000000000515A000-memory.dmp
memory/2384-123-0x0000000007790000-0x00000000077CC000-memory.dmp
memory/3964-124-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3964-126-0x0000000000400000-0x00000000004A2000-memory.dmp