Analysis
-
max time kernel
58s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 03:43
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.28996.exe
-
Size
196KB
-
MD5
df608b1e6ca45b46e336d6b2c1459f80
-
SHA1
487d773c1c290028ef6070f4650ab9f59bea1dc5
-
SHA256
436f9c683b9e4050424953affd1d48ea9973687a89763b7f83d81cf5eb0ec7d2
-
SHA512
5a2e81fc0648cae440c9545b8a2190ea4773ede90a50e2ccfe9252ba47aa65d14f7c54cd8d12e4bbcd8be0a0e58ffc211d40cf85188674b9d322922e399fc231
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.28996.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.28996.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
-
Filesize
648KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
24KB
-
Filesize
104KB
-
Filesize
24KB
-
Filesize
224KB