Analysis

  • max time kernel
    160s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07-07-2022 17:22

General

  • Target

    4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1.exe

  • Size

    198KB

  • MD5

    3eab5d298c5423ff30cef60036c43472

  • SHA1

    4fd1130b9c5fd2d11e5aa8f2d600fed73b59e636

  • SHA256

    4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1

  • SHA512

    497895b549a67d7a10e6c59f71cc42fb11a026184e676cd9af7328a4e0165662ac6c923e37cc693a6a5f4326836e4f96aba5c81d68348eff4bf97e964ccdd43e

Malware Config

Extracted

Family

lokibot

C2

http://leadingfreightgroup.com/doings/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1.exe
    "C:\Users\Admin\AppData\Local\Temp\4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Roaming\app.exe
      "C:\Users\Admin\AppData\Roaming\app.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Users\Admin\AppData\Roaming\app.exe
        "C:\Users\Admin\AppData\Roaming\app.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3404
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /SC MINUTE /TN Application /TR C:\Users\Admin\AppData\Roaming\app.exe
      2⤵
      • Creates scheduled task(s)
      PID:1948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\app.exe

    Filesize

    198KB

    MD5

    3eab5d298c5423ff30cef60036c43472

    SHA1

    4fd1130b9c5fd2d11e5aa8f2d600fed73b59e636

    SHA256

    4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1

    SHA512

    497895b549a67d7a10e6c59f71cc42fb11a026184e676cd9af7328a4e0165662ac6c923e37cc693a6a5f4326836e4f96aba5c81d68348eff4bf97e964ccdd43e

  • C:\Users\Admin\AppData\Roaming\app.exe

    Filesize

    198KB

    MD5

    3eab5d298c5423ff30cef60036c43472

    SHA1

    4fd1130b9c5fd2d11e5aa8f2d600fed73b59e636

    SHA256

    4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1

    SHA512

    497895b549a67d7a10e6c59f71cc42fb11a026184e676cd9af7328a4e0165662ac6c923e37cc693a6a5f4326836e4f96aba5c81d68348eff4bf97e964ccdd43e

  • C:\Users\Admin\AppData\Roaming\app.exe

    Filesize

    198KB

    MD5

    3eab5d298c5423ff30cef60036c43472

    SHA1

    4fd1130b9c5fd2d11e5aa8f2d600fed73b59e636

    SHA256

    4508bb625c6944b5d749fc10d9abef3ecdbeef7a58c6607b07597311d8f48cb1

    SHA512

    497895b549a67d7a10e6c59f71cc42fb11a026184e676cd9af7328a4e0165662ac6c923e37cc693a6a5f4326836e4f96aba5c81d68348eff4bf97e964ccdd43e

  • memory/1948-137-0x0000000000000000-mapping.dmp

  • memory/3404-138-0x0000000000000000-mapping.dmp

  • memory/3404-145-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3404-144-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3404-140-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/3568-136-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3568-135-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3568-143-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3568-132-0x0000000000000000-mapping.dmp

  • memory/4188-139-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4188-130-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4188-131-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB