Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 18:38

General

  • Target

    be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e.exe

  • Size

    1.9MB

  • MD5

    18fb6a614288a4408b20e15c7f92b9b9

  • SHA1

    ca022f1388dc01b5aae9a3323c994c39fc7a3aa6

  • SHA256

    be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e

  • SHA512

    1382eb8c7792156f90c3f48f4fa216b19390983e18cb911b86d8b921347e369980526344ba2582d8f368adb3ca4f0fe0f6efca155fb13b966309b3e91ce17a12

Malware Config

Extracted

Family

lokibot

C2

http://kaveriyarns.com/test/five/fre

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e.exe
    "C:\Users\Admin\AppData\Local\Temp\be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e.exe
      "C:\Users\Admin\AppData\Local\Temp\be7970e887e25ba0fb3d7c0786b3af50a4066ec0b7a01f4b5110aeaf7ac9620e.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-56-0x0000000000280000-0x0000000000298000-memory.dmp
    Filesize

    96KB

  • memory/1084-57-0x0000000075CF1000-0x0000000075CF3000-memory.dmp
    Filesize

    8KB

  • memory/1084-59-0x0000000077060000-0x0000000077209000-memory.dmp
    Filesize

    1.7MB

  • memory/1084-60-0x0000000077240000-0x00000000773C0000-memory.dmp
    Filesize

    1.5MB

  • memory/1664-61-0x00000000004C7C3B-mapping.dmp
  • memory/1664-65-0x0000000077060000-0x0000000077209000-memory.dmp
    Filesize

    1.7MB

  • memory/1664-66-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/1664-64-0x0000000000400000-0x00000000005F1000-memory.dmp
    Filesize

    1.9MB