Analysis
- max time kernel
140s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 16:21
General
- Target a8bcdc327acc10880c3755847d99b1e0.exe
- Size 817KB
- Sample220216-ttpnvsdber
- SHA256 83bbad41df5042e97775e39a88ad8df4ba22b41dbd90c11e9ca611725d00f184
Malware Config
Extracted
-
lokibot
-
http://164.90.194.235/?id=13027041768301216
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8bcdc327acc10880c3755847d99b1e0.exe"C:\Users\Admin\AppData\Local\Temp\a8bcdc327acc10880c3755847d99b1e0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\igDtPi.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\igDtPi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF819.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\a8bcdc327acc10880c3755847d99b1e0.exe"C:\Users\Admin\AppData\Local\Temp\a8bcdc327acc10880c3755847d99b1e0.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2316-148-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2316-140-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2440-146-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/2440-152-0x0000000070800000-0x000000007084C000-memory.dmp
memory/2440-161-0x0000000007A80000-0x0000000007A88000-memory.dmp
memory/2440-160-0x0000000007AA0000-0x0000000007ABA000-memory.dmp
memory/2440-159-0x0000000007990000-0x000000000799E000-memory.dmp
memory/2440-138-0x0000000004F00000-0x0000000004F36000-memory.dmp
memory/2440-158-0x00000000079E0000-0x0000000007A76000-memory.dmp
memory/2440-156-0x000000007F220000-0x000000007F221000-memory.dmp
memory/2440-141-0x0000000005570000-0x0000000005B98000-memory.dmp
memory/2440-142-0x00000000054A0000-0x00000000054C2000-memory.dmp
memory/2440-143-0x0000000005D90000-0x0000000005DF6000-memory.dmp
memory/2440-144-0x0000000005E00000-0x0000000005E66000-memory.dmp
memory/2440-145-0x000000007444E000-0x000000007444F000-memory.dmp
memory/2440-157-0x00000000077D0000-0x00000000077DA000-memory.dmp
memory/2440-155-0x0000000007760000-0x000000000777A000-memory.dmp
memory/2440-149-0x0000000006450000-0x000000000646E000-memory.dmp
memory/2440-147-0x0000000002B42000-0x0000000002B43000-memory.dmp
memory/2440-150-0x0000000002B45000-0x0000000002B47000-memory.dmp
memory/2440-151-0x0000000007440000-0x0000000007472000-memory.dmp
memory/2440-154-0x0000000007DB0000-0x000000000842A000-memory.dmp
memory/2440-153-0x00000000069E0000-0x00000000069FE000-memory.dmp
memory/3140-134-0x000001CC64780000-0x000001CC64790000-memory.dmp
memory/3140-136-0x000001CC67500000-0x000001CC67504000-memory.dmp
memory/3140-135-0x000001CC64E20000-0x000001CC64E30000-memory.dmp
memory/4196-131-0x000000007444E000-0x000000007444F000-memory.dmp
memory/4196-130-0x0000000000690000-0x0000000000762000-memory.dmp
memory/4196-132-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/4196-133-0x0000000005300000-0x0000000005301000-memory.dmp
memory/4196-137-0x00000000054B0000-0x000000000554C000-memory.dmp