Analysis
-
max time kernel
94s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 01:48
General
-
Target
8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe
-
Size
773KB
-
MD5
4eed468b0e55bf002a7c9794cbef7f11
-
SHA1
12e328496090290adfa3447c3c86ea28a2269ec9
-
SHA256
8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23
-
SHA512
6672450f359f1ff93fd4f8df600970892bdab376a6f5bb111cb3d08c4c461f23e8a31dd9de338c798dd9ac9eb8a1c9f1b01f1fb116325d63f75bdec77f524f3b
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=11563538709035308
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe"C:\Users\Admin\AppData\Local\Temp\8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cECtYfI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cECtYfI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5FF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe"C:\Users\Admin\AppData\Local\Temp\8275697787639625be4a663711127bfe1c84c0b08b67d8d6c59fdd1890130b23.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD531ddf6dd3f1d6e644499910407a29087
SHA1baa9d0fcf988501bdfe5c62c2452188ac464058f
SHA2568de3674213e2c6b161b8081e136937f705922d59c8db29897deda745d06cd087
SHA512b3c7a7054d7b0cb2a40226cc79ea979cacb34d6247fb6806d7ce50d46e6541f541a76a4191e3c3680e7450df7f034a1d3a2d65af5bf02aa744f0236bac90002b
-
C:\Users\Admin\AppData\Local\Temp\tmpC5FF.tmpFilesize
1KB
MD58ded8c556511e0cb3a1982a87169b03b
SHA13738293728dc7a716a6f08dcb44737ca48e6385a
SHA256287250f7257560d5ddaf5f54120153d34712889751a9681802dfe1c8bf8c6342
SHA5125227862dcaca0be28046fd4c6dd4092f8bb47ad4706c986c57c24e7579505eb07ca9883d42549531a68ca322c09c005cdf8b4dda784fedef8abf336d6d5e12d8
-
memory/2192-149-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2192-148-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2192-145-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2192-144-0x0000000000000000-mapping.dmp
-
memory/2980-158-0x0000000007030000-0x000000000703E000-memory.dmpFilesize
56KB
-
memory/2980-146-0x0000000005AF0000-0x0000000005B0E000-memory.dmpFilesize
120KB
-
memory/2980-153-0x000000006F420000-0x000000006F46C000-memory.dmpFilesize
304KB
-
memory/2980-139-0x0000000000000000-mapping.dmp
-
memory/2980-159-0x0000000007140000-0x000000000715A000-memory.dmpFilesize
104KB
-
memory/3136-134-0x0000000008530000-0x00000000085CC000-memory.dmpFilesize
624KB
-
memory/3136-130-0x0000000000010000-0x00000000000D6000-memory.dmpFilesize
792KB
-
memory/3136-135-0x0000000008C80000-0x0000000008CE6000-memory.dmpFilesize
408KB
-
memory/3136-133-0x0000000004B00000-0x0000000004B0A000-memory.dmpFilesize
40KB
-
memory/3136-132-0x0000000004950000-0x00000000049E2000-memory.dmpFilesize
584KB
-
memory/3136-131-0x0000000004E60000-0x0000000005404000-memory.dmpFilesize
5.6MB
-
memory/4544-140-0x0000000000000000-mapping.dmp
-
memory/5032-138-0x0000000004E10000-0x0000000005438000-memory.dmpFilesize
6.2MB
-
memory/5032-151-0x000000006F420000-0x000000006F46C000-memory.dmpFilesize
304KB
-
memory/5032-150-0x00000000060A0000-0x00000000060D2000-memory.dmpFilesize
200KB
-
memory/5032-152-0x0000000006020000-0x000000000603E000-memory.dmpFilesize
120KB
-
memory/5032-154-0x0000000007420000-0x0000000007A9A000-memory.dmpFilesize
6.5MB
-
memory/5032-155-0x0000000006DE0000-0x0000000006DFA000-memory.dmpFilesize
104KB
-
memory/5032-156-0x0000000006E50000-0x0000000006E5A000-memory.dmpFilesize
40KB
-
memory/5032-157-0x0000000007060000-0x00000000070F6000-memory.dmpFilesize
600KB
-
memory/5032-142-0x0000000005440000-0x00000000054A6000-memory.dmpFilesize
408KB
-
memory/5032-141-0x0000000004A10000-0x0000000004A32000-memory.dmpFilesize
136KB
-
memory/5032-160-0x0000000007100000-0x0000000007108000-memory.dmpFilesize
32KB
-
memory/5032-137-0x00000000021E0000-0x0000000002216000-memory.dmpFilesize
216KB
-
memory/5032-136-0x0000000000000000-mapping.dmp