Overview

overview

10

Static

static

465977788b...dc.exe

windows7_x64

10

465977788b...dc.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    38s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    07-07-2022 09:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe

  • Size

    744KB

  • MD5

    d2daf6b87d2c88e6807585411875707f

  • SHA1

    8ac823dae8765469db4dcf088d27e7dca50e2793

  • SHA256

    465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc

  • SHA512

    67d63edc4b13f729d5be7c519c2adf79d2a6c9f3fd5e465e892204b3005594a58a0be6f1dda861ad85a29cc89df32733d73d1bd19c844d73cc3a251fb7a8f160

Score
10/10
lokibotcollectionpersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://hs-bc-grps.com/file/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 4 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
    "C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msconfig.exe;
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1628
    • C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
      "C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
        "C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe"
        3⤵
          PID:1400
        • C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
          C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
          3⤵
            PID:900
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im taskmgr.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:340
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im msconfig.exe;
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1056
        • C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
          C:\Users\Admin\AppData\Local\Temp\465977788baf5301b58da983918804a2415b2954bfb8ecd694336b34220038dc.exe
          2⤵
            PID:1708
          • C:\Users\Admin\AppData\Local\Temp\92042.exe
            "C:\Users\Admin\AppData\Local\Temp\92042.exe"
            2⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • outlook_office_path
            • outlook_win_path
            PID:1528

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\92042.exe
          Filesize

          104KB

          MD5

          80afb097e9b68f15837a49604f1fe027

          SHA1

          30ded5cab5d3e904132ae1ee70c33cb4bff37175

          SHA256

          964fa46921540acc8518567688f7eedfba62c1f40377e65f48f42b17105cdc75

          SHA512

          a18d04b1aa06cddc223c8d8559ee7b843c0ce0555fe13fe9cdbd4301b622f8fb7fceb74d9ab8e4cbb40e3ed63e5d7327f129afb27ac427c80eb5f0bb168ccaf8

          Download Submit
        • \Users\Admin\AppData\Local\Temp\92042.exe
          Filesize

          104KB

          MD5

          80afb097e9b68f15837a49604f1fe027

          SHA1

          30ded5cab5d3e904132ae1ee70c33cb4bff37175

          SHA256

          964fa46921540acc8518567688f7eedfba62c1f40377e65f48f42b17105cdc75

          SHA512

          a18d04b1aa06cddc223c8d8559ee7b843c0ce0555fe13fe9cdbd4301b622f8fb7fceb74d9ab8e4cbb40e3ed63e5d7327f129afb27ac427c80eb5f0bb168ccaf8

          Download Submit
        • \Users\Admin\AppData\Local\Temp\92042.exe
          Filesize

          104KB

          MD5

          80afb097e9b68f15837a49604f1fe027

          SHA1

          30ded5cab5d3e904132ae1ee70c33cb4bff37175

          SHA256

          964fa46921540acc8518567688f7eedfba62c1f40377e65f48f42b17105cdc75

          SHA512

          a18d04b1aa06cddc223c8d8559ee7b843c0ce0555fe13fe9cdbd4301b622f8fb7fceb74d9ab8e4cbb40e3ed63e5d7327f129afb27ac427c80eb5f0bb168ccaf8

          Download Submit
        • memory/112-58-0x0000000000000000-mapping.dmp
          Download
        • memory/112-67-0x0000000074AC0000-0x000000007506B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/112-75-0x0000000074AC0000-0x000000007506B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/340-71-0x0000000000000000-mapping.dmp
          Download
        • memory/900-72-0x00000000004139DE-mapping.dmp
          Download
        • memory/1056-73-0x0000000000000000-mapping.dmp
          Download
        • memory/1112-56-0x0000000000000000-mapping.dmp
          Download
        • memory/1400-69-0x0000000000000000-mapping.dmp
          Download
        • memory/1400-76-0x0000000074AC0000-0x000000007506B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1528-63-0x0000000000000000-mapping.dmp
          Download
        • memory/1628-57-0x0000000000000000-mapping.dmp
          Download
        • memory/1708-60-0x00000000004139DE-mapping.dmp
          Download
        • memory/1788-55-0x00000000021B0000-0x00000000021DE000-memory.dmp
          Filesize

          184KB

          Download
        • memory/1788-68-0x0000000074AC0000-0x000000007506B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1788-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
          Filesize

          8KB

          Download