Analysis
- max time kernel
151s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 09:32
General
- Target 7a9302e65a81c949b9ac705b78063176.exe
- Size 927KB
- Sample220321-lhlttsbcbk
- SHA256 5d619b8944c749501aed6403110cdbbb71ca435dcf221eb442790f5cb03bb712
Malware Config
Extracted
-
lokibot
-
http://furnaceshst.net/ge5/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9302e65a81c949b9ac705b78063176.exe"C:\Users\Admin\AppData\Local\Temp\7a9302e65a81c949b9ac705b78063176.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a9302e65a81c949b9ac705b78063176.exe"C:\Users\Admin\AppData\Local\Temp\7a9302e65a81c949b9ac705b78063176.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3556-147-0x000001F33E9E0000-0x000001F33E9E4000-memory.dmp
memory/3556-148-0x000001F33E9C0000-0x000001F33E9C1000-memory.dmp
memory/3556-152-0x000001F33E630000-0x000001F33E631000-memory.dmp
memory/3556-151-0x000001F33E730000-0x000001F33E734000-memory.dmp
memory/3556-150-0x000001F33E730000-0x000001F33E731000-memory.dmp
memory/3556-142-0x000001F33E710000-0x000001F33E714000-memory.dmp
memory/3556-140-0x000001F33B790000-0x000001F33B7A0000-memory.dmp
memory/3556-141-0x000001F33C320000-0x000001F33C330000-memory.dmp
memory/3556-149-0x000001F33E740000-0x000001F33E744000-memory.dmp
memory/4576-139-0x0000000005830000-0x000000000583A000-memory.dmp
memory/4576-143-0x0000000007E70000-0x0000000007F0C000-memory.dmp
memory/4576-134-0x0000000074A60000-0x0000000075210000-memory.dmp
memory/4576-135-0x0000000000D80000-0x0000000000E6E000-memory.dmp
memory/4576-138-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/4576-137-0x0000000005880000-0x0000000005912000-memory.dmp
memory/4576-136-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/4816-146-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4816-144-0x0000000000400000-0x00000000004A2000-memory.dmp