Analysis
- max time kernel
143s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 15:18
General
- Target A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe
- Size 561KB
- Sample220321-splkzaddfr
- SHA256 a510389aca7e39df029d0f4974f63a70010270f589bc7f6095d523687196f08f
Malware Config
Extracted
-
lokibot
-
http://141.105.64.222/office/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe"C:\Users\Admin\AppData\Local\Temp\A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe"C:\Users\Admin\AppData\Local\Temp\A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe"2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1292-134-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/1292-135-0x0000000000660000-0x00000000006F2000-memory.dmp
memory/1292-136-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/1292-137-0x0000000005150000-0x00000000051E2000-memory.dmp
memory/1292-138-0x00000000050B0000-0x0000000005654000-memory.dmp
memory/1292-139-0x0000000005120000-0x000000000512A000-memory.dmp
memory/1292-143-0x0000000007CF0000-0x0000000007D8C000-memory.dmp
memory/3276-145-0x0000000000780000-0x0000000000822000-memory.dmp
memory/3828-142-0x0000018B304C0000-0x0000018B304C4000-memory.dmp
memory/3828-141-0x0000018B2E120000-0x0000018B2E130000-memory.dmp
memory/3828-140-0x0000018B2D540000-0x0000018B2D550000-memory.dmp
memory/3828-147-0x0000018B30790000-0x0000018B30794000-memory.dmp
memory/3828-148-0x0000018B30770000-0x0000018B30771000-memory.dmp
memory/3828-149-0x0000018B304F0000-0x0000018B304F4000-memory.dmp
memory/3828-150-0x0000018B304E0000-0x0000018B304E1000-memory.dmp
memory/3828-151-0x0000018B304E0000-0x0000018B304E4000-memory.dmp
memory/3828-152-0x0000018B2E1E0000-0x0000018B2E1E1000-memory.dmp