Analysis

  • max time kernel
    42s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 23:21

General

  • Target

    5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe

  • Size

    271KB

  • MD5

    6d6e6d27380ce69f043be7dc379fbf15

  • SHA1

    7078801fbf3ef2523958b0431a56a07a9002d1e9

  • SHA256

    5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6

  • SHA512

    36d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f

Malware Config

Extracted

Family

lokibot

C2

http://timmason2.com/demoami/demoami/iu/y/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe
    "C:\Users\Admin\AppData\Local\Temp\5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.lnk" /f
        3⤵
          PID:1984
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        2⤵
        • Executes dropped EXE
        PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:524
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 300
          3⤵
          • Delays execution with timeout.exe
          PID:624

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      Filesize

      1.6MB

      MD5

      32827e69b293b99013bbbe37d029245d

      SHA1

      bc9f80a38f09354d71467a05b0c5a82c3f7dac53

      SHA256

      9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

      SHA512

      58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

    • C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe
      Filesize

      271KB

      MD5

      6d6e6d27380ce69f043be7dc379fbf15

      SHA1

      7078801fbf3ef2523958b0431a56a07a9002d1e9

      SHA256

      5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6

      SHA512

      36d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f

    • C:\Users\Admin\AppData\Roaming\txi7\tzt7.exe.bat
      Filesize

      198B

      MD5

      2e5cd464a7f51445d81d8f7b258f85e1

      SHA1

      af8f08d277d72704eeb6b518a554bd6f5d904aea

      SHA256

      832c62f71c5b1af187b7c48a30871af8fdb7942c95d8c172f3b92635d387b729

      SHA512

      83dd4ad13e31c64403a4aa5b3ecc5c844a6f8ad71e5dac8b4fa8c6ad5c09277f6fac72db4258f2df84d571436f0f4d60b7a599d11bfdea32a2fbfa4b09109fba

    • \Users\Admin\AppData\Local\Temp\svhost.exe
      Filesize

      1.6MB

      MD5

      32827e69b293b99013bbbe37d029245d

      SHA1

      bc9f80a38f09354d71467a05b0c5a82c3f7dac53

      SHA256

      9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

      SHA512

      58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

    • \Users\Admin\AppData\Roaming\txi7\tzt7.exe
      Filesize

      271KB

      MD5

      6d6e6d27380ce69f043be7dc379fbf15

      SHA1

      7078801fbf3ef2523958b0431a56a07a9002d1e9

      SHA256

      5d7865a5bf7fab4231f56e3794a271a297667e1a9bdf0d3c9615a3a30475e3c6

      SHA512

      36d521333c8bb5bebae18a838629bbbc40cb5ec6922b823d2298ccd83c0808311407cc88ae7f22bd0722261a6b2a9372891cdacd9ba10398cdb48f777480209f

    • memory/524-74-0x0000000000000000-mapping.dmp
    • memory/624-76-0x0000000000000000-mapping.dmp
    • memory/648-73-0x0000000074770000-0x0000000074D1B000-memory.dmp
      Filesize

      5.7MB

    • memory/648-77-0x0000000074770000-0x0000000074D1B000-memory.dmp
      Filesize

      5.7MB

    • memory/648-54-0x0000000075321000-0x0000000075323000-memory.dmp
      Filesize

      8KB

    • memory/1772-63-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1772-69-0x00000000004139DE-mapping.dmp
    • memory/1772-71-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1772-66-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1772-65-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1772-61-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1772-60-0x0000000000080000-0x0000000000122000-memory.dmp
      Filesize

      648KB

    • memory/1984-56-0x0000000000000000-mapping.dmp
    • memory/2032-55-0x0000000000000000-mapping.dmp