Analysis

  • max time kernel
    152s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2023, 21:44

General

  • Target

    e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92.exe

  • Size

    937KB

  • MD5

    dabd16e5652edadf33f6fb69ab386a5a

  • SHA1

    2267c6c71507fc3e5c0db2f595e649527b34a2e3

  • SHA256

    e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92

  • SHA512

    3bb0346b642ab5d91f194d787c6f04257f42d6e67af013b7d553463bc3a278e108c7716a013d01e59e0da98ae71aa0c10f51d923c1e9ab63c0b11045ce39cac0

  • SSDEEP

    12288:2LUBlEkey/BiXAUQicsli6d4usYS6/2ioGpmoAIooPTrStDtiFxM+AFEF:dllp/8RQL6gQ2ioYAIoIrStZiFW+AFE

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha16/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92.exe
    "C:\Users\Admin\AppData\Local\Temp\e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92.exe
      "C:\Users\Admin\AppData\Local\Temp\e9c64471b4c246a56482795221391c1321f0b95e658841d3ebe379fc51b05a92.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2008

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1236-54-0x00000000008C0000-0x00000000009B0000-memory.dmp

          Filesize

          960KB

        • memory/1236-55-0x0000000000840000-0x0000000000880000-memory.dmp

          Filesize

          256KB

        • memory/1236-56-0x00000000004D0000-0x00000000004E6000-memory.dmp

          Filesize

          88KB

        • memory/1236-57-0x0000000000840000-0x0000000000880000-memory.dmp

          Filesize

          256KB

        • memory/1236-58-0x00000000004F0000-0x00000000004FC000-memory.dmp

          Filesize

          48KB

        • memory/1236-59-0x0000000005A90000-0x0000000005B2A000-memory.dmp

          Filesize

          616KB

        • memory/1236-60-0x0000000002040000-0x0000000002062000-memory.dmp

          Filesize

          136KB

        • memory/2008-61-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-62-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-63-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-64-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-65-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2008-67-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-69-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-70-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/2008-75-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB