Analysis
-
max time kernel
91s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 07:46
General
-
Target
42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe
-
Size
590KB
-
MD5
07cf462fc4e3db6e4067273d2669dbcb
-
SHA1
6b3925aaba48a0b863d60ecebeb46c1570240670
-
SHA256
42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01
-
SHA512
d8d90f0c927f8e43314e549615c042ca2564aa69f1fa755741cc99e3d8b7d087d1878c6b7048a88f366ecfebbadcfba8b701e9b4f865b53efbc1c6a55779aefd
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=11563538709035308
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe"C:\Users\Admin\AppData\Local\Temp\42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fWimGJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fWimGJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp824F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe"C:\Users\Admin\AppData\Local\Temp\42b9985586ad99224f2b238f89dcafda4c2dea3c6c76a70314e6080c41f0ab01.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD559186e4cb50702a975aac10b38058e90
SHA1ac77352d8272a150980ec76678f3d38336e88cc6
SHA25628ef27b7e9ed2a2e6c6495cff75409be172aabfb4857c4911fe93032f903cebc
SHA512c05b410742a35ceff2fdcb2f3ec19e6bc091f7e8a8ac9dca92e111fb399a1b67d153142db8ea8d081de6a49b26ef073e28da20ce74d9a5f630b58a09d0c98318
-
C:\Users\Admin\AppData\Local\Temp\tmp824F.tmpFilesize
1KB
MD5abfdb872ade044ac043d7f3c21710747
SHA186eefebc8a4ac5f970508520ded478d24f8ca3be
SHA2561bf0fa73c595aa8b27f41bb8eb27b2bc8c633f9f2917c76fecf3b7e7ae8f2172
SHA5129027172b997543d9ad52e56e77bb965fcd3a38cac9274888ac42b8893f78d92f9481af5b64da8b307b29b4be29cb5f3c7e4f4b9a8462a5b7ca77bae905b91f64
-
memory/440-147-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/440-145-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/440-144-0x0000000000000000-mapping.dmp
-
memory/440-149-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1876-130-0x0000000000130000-0x00000000001C8000-memory.dmpFilesize
608KB
-
memory/1876-135-0x0000000008A50000-0x0000000008AB6000-memory.dmpFilesize
408KB
-
memory/1876-134-0x0000000008540000-0x00000000085DC000-memory.dmpFilesize
624KB
-
memory/1876-133-0x0000000004D20000-0x0000000004D2A000-memory.dmpFilesize
40KB
-
memory/1876-132-0x0000000004B60000-0x0000000004BF2000-memory.dmpFilesize
584KB
-
memory/1876-131-0x00000000053C0000-0x0000000005964000-memory.dmpFilesize
5.6MB
-
memory/2784-142-0x0000000000000000-mapping.dmp
-
memory/2876-160-0x00000000076A0000-0x00000000076A8000-memory.dmpFilesize
32KB
-
memory/2876-158-0x00000000075B0000-0x00000000075BE000-memory.dmpFilesize
56KB
-
memory/2876-141-0x0000000000000000-mapping.dmp
-
memory/2876-155-0x000000006F870000-0x000000006F8BC000-memory.dmpFilesize
304KB
-
memory/3436-138-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/3436-150-0x0000000007040000-0x0000000007072000-memory.dmpFilesize
200KB
-
memory/3436-151-0x000000006F870000-0x000000006F8BC000-memory.dmpFilesize
304KB
-
memory/3436-152-0x0000000006620000-0x000000000663E000-memory.dmpFilesize
120KB
-
memory/3436-153-0x00000000079B0000-0x000000000802A000-memory.dmpFilesize
6.5MB
-
memory/3436-148-0x0000000006060000-0x000000000607E000-memory.dmpFilesize
120KB
-
memory/3436-154-0x0000000007360000-0x000000000737A000-memory.dmpFilesize
104KB
-
memory/3436-156-0x00000000073D0000-0x00000000073DA000-memory.dmpFilesize
40KB
-
memory/3436-157-0x00000000075E0000-0x0000000007676000-memory.dmpFilesize
600KB
-
memory/3436-140-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/3436-159-0x00000000076A0000-0x00000000076BA000-memory.dmpFilesize
104KB
-
memory/3436-139-0x00000000050D0000-0x00000000050F2000-memory.dmpFilesize
136KB
-
memory/3436-137-0x0000000002730000-0x0000000002766000-memory.dmpFilesize
216KB
-
memory/3436-136-0x0000000000000000-mapping.dmp