Analysis

  • max time kernel
    111s
  • max time network
    114s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-02-2023 13:34

General

  • Target

    b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe

  • Size

    668KB

  • MD5

    06f61b2e8dcaeb8e8a1e80611d53baa5

  • SHA1

    e97262db5f421274929d9d190d9f45734737f201

  • SHA256

    b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9

  • SHA512

    e834bf7fe272a929a9b3b93e7e0786e9ada09fc42e76049845909a140b5b94cac22174462d7af72c09b90566e0af3b81c32e18a043d7cf7d8ce4e4b22b25b9b1

  • SSDEEP

    12288:ttz8L6guub02iDBd0ER+pVj4pmLoU25nntk6PUi+9xMRSR5SWqG4yPa:wLz0LDwIij4cLNItvX4yRU5JqG4yPa

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe
    "C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe
      "C:\Users\Admin\AppData\Local\Temp\b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2000-188-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2000-189-0x00000000004139DE-mapping.dmp
  • memory/2000-190-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2000-191-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2000-192-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2000-243-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2000-230-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

  • memory/2696-152-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-126-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-123-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-124-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-125-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-156-0x0000000005700000-0x0000000005BFE000-memory.dmp
    Filesize

    5.0MB

  • memory/2696-127-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-128-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-129-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-157-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-131-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-132-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-133-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-134-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-135-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-136-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-137-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-138-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-139-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-140-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-141-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-142-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-143-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-144-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-145-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-146-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-147-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-148-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-149-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-150-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-151-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-121-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-153-0x0000000000900000-0x00000000009AE000-memory.dmp
    Filesize

    696KB

  • memory/2696-154-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-184-0x0000000008910000-0x000000000891A000-memory.dmp
    Filesize

    40KB

  • memory/2696-122-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-130-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-158-0x0000000005200000-0x0000000005292000-memory.dmp
    Filesize

    584KB

  • memory/2696-159-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-160-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-161-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-162-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-163-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-164-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-165-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-166-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-167-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-168-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-169-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-170-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-171-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-172-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-173-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-174-0x0000000005360000-0x000000000536A000-memory.dmp
    Filesize

    40KB

  • memory/2696-175-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-176-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-177-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-178-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-179-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-180-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-181-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-182-0x0000000008670000-0x0000000008684000-memory.dmp
    Filesize

    80KB

  • memory/2696-120-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-119-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-183-0x00000000089A0000-0x0000000008A3C000-memory.dmp
    Filesize

    624KB

  • memory/2696-155-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-185-0x0000000077840000-0x00000000779CE000-memory.dmp
    Filesize

    1.6MB

  • memory/2696-186-0x0000000008BF0000-0x0000000008C4A000-memory.dmp
    Filesize

    360KB

  • memory/2696-187-0x0000000008C60000-0x0000000008C82000-memory.dmp
    Filesize

    136KB