Analysis

  • max time kernel
    208s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 21:24

General

  • Target

    f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a.exe

  • Size

    858KB

  • MD5

    342ac5fa7bbc97dc1b30194edcb36194

  • SHA1

    c228f11363a71e968a798ff9348291968fd4e525

  • SHA256

    f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a

  • SHA512

    953b12448e2ae40e8c7667178a80083ebdbf528eb6ccee3d32ee0ee51a3235d89dd337100ba708ae6e874d1b4e1a699fe2fdb86287130a3585de369bfaa956dd

  • SSDEEP

    12288:XLJYn4y5kSN2GKPv61ig2j78A/VPsPdoAVPas1ZsUDrrxN6pdvUU3dIQbZlcnIKP:6nxi/9P+28AquAVzcUD5NMdvU

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/ZtkNeeK6C94X6

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a.exe
    "C:\Users\Admin\AppData\Local\Temp\f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a.exe
      "C:\Users\Admin\AppData\Local\Temp\f6e7c3b2fcd2944e123bc68b46f881d266a5099e36b65a4d3fbc9e04195d603a.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:2684

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2156-132-0x00000000007C0000-0x000000000089C000-memory.dmp
    Filesize

    880KB

  • memory/2156-133-0x0000000007600000-0x000000000769C000-memory.dmp
    Filesize

    624KB

  • memory/2156-134-0x0000000007C50000-0x00000000081F4000-memory.dmp
    Filesize

    5.6MB

  • memory/2156-135-0x00000000076A0000-0x0000000007732000-memory.dmp
    Filesize

    584KB

  • memory/2156-136-0x00000000075E0000-0x00000000075EA000-memory.dmp
    Filesize

    40KB

  • memory/2156-137-0x0000000007890000-0x00000000078E6000-memory.dmp
    Filesize

    344KB

  • memory/2684-138-0x0000000000000000-mapping.dmp
  • memory/2684-139-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2684-141-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2684-142-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2684-143-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB