Analysis
-
max time kernel
74s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 07:46
General
-
Target
bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe
-
Size
432KB
-
MD5
9d4e7e2c7d3e65ff35bbaea47d87ea62
-
SHA1
ef739f134df997816a769735d8f198a7f092cefe
-
SHA256
bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe
-
SHA512
93ae6c45fa15df78eeb77a3da56004f6ef836ce60c010f682b0e662aad60bb4b011e295aa82123bffef995e166b993426cac165519d5371cb2052fd63891919b
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=11563538709035308
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe"C:\Users\Admin\AppData\Local\Temp\bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JntEpuQx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JntEpuQx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp543A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe"C:\Users\Admin\AppData\Local\Temp\bf8359d06b0fdd13cafd6b39b424073bfa65584223c3b477c53a166bfd8303fe.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53d4d19fe1bfe80c9a0fe95eb5833ca23
SHA1d019ce696b67f2bbbc090a449ce1dae063aea089
SHA256d953efe54c83aaf8ce931c9cccf40c3b43d069f0ab46c5978788348a4a240564
SHA5126e4fc3c48a310fd28004b568c87d3cbda4822a2f2cdf07f1a88d9d1fd7ce9c2504ed138e9d51349342423f8f06458ac71bf5324a45d0e870e3328ec3f0a7216c
-
C:\Users\Admin\AppData\Local\Temp\tmp543A.tmpFilesize
1KB
MD59e488ee21b0ddadbdcf1e5024853af29
SHA15a4df7328aeae212cb0603e9e321f835bcd4282e
SHA256b5c1f6a8b48d2018d1f677b175573c495591262b753829311b853378a9913955
SHA5122770a704a5d785d670ae6f7e4e51758241d7ed08b6dbd33cdddc2e3c5828ee1c9fe590da88b126d62dff79d7fee19e9c602b19d61917e4417d46f12ed7e47343
-
memory/876-133-0x00000000056D0000-0x000000000576C000-memory.dmpFilesize
624KB
-
memory/876-134-0x0000000005530000-0x000000000553A000-memory.dmpFilesize
40KB
-
memory/876-135-0x0000000009340000-0x00000000093A6000-memory.dmpFilesize
408KB
-
memory/876-132-0x0000000005590000-0x0000000005622000-memory.dmpFilesize
584KB
-
memory/876-130-0x0000000000B10000-0x0000000000B82000-memory.dmpFilesize
456KB
-
memory/876-131-0x0000000005AA0000-0x0000000006044000-memory.dmpFilesize
5.6MB
-
memory/1532-142-0x0000000000000000-mapping.dmp
-
memory/2620-145-0x0000000000000000-mapping.dmp
-
memory/2620-149-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2620-148-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2620-146-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4408-138-0x00000000052D0000-0x00000000058F8000-memory.dmpFilesize
6.2MB
-
memory/4408-158-0x0000000007540000-0x000000000754E000-memory.dmpFilesize
56KB
-
memory/4408-136-0x0000000000000000-mapping.dmp
-
memory/4408-141-0x0000000005900000-0x0000000005966000-memory.dmpFilesize
408KB
-
memory/4408-139-0x0000000005120000-0x0000000005142000-memory.dmpFilesize
136KB
-
memory/4408-137-0x00000000026D0000-0x0000000002706000-memory.dmpFilesize
216KB
-
memory/4408-150-0x00000000065E0000-0x0000000006612000-memory.dmpFilesize
200KB
-
memory/4408-153-0x000000006F9A0000-0x000000006F9EC000-memory.dmpFilesize
304KB
-
memory/4408-144-0x0000000004D90000-0x0000000004DAE000-memory.dmpFilesize
120KB
-
memory/4408-154-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/4408-155-0x0000000007310000-0x000000000732A000-memory.dmpFilesize
104KB
-
memory/4408-157-0x0000000007590000-0x0000000007626000-memory.dmpFilesize
600KB
-
memory/5088-156-0x0000000007120000-0x000000000712A000-memory.dmpFilesize
40KB
-
memory/5088-152-0x0000000006340000-0x000000000635E000-memory.dmpFilesize
120KB
-
memory/5088-159-0x00000000073F0000-0x000000000740A000-memory.dmpFilesize
104KB
-
memory/5088-160-0x00000000073D0000-0x00000000073D8000-memory.dmpFilesize
32KB
-
memory/5088-151-0x000000006F9A0000-0x000000006F9EC000-memory.dmpFilesize
304KB
-
memory/5088-140-0x0000000000000000-mapping.dmp