Analysis
-
max time kernel
140s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
19/11/2023, 21:29
General
-
Target
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe
-
Size
2.2MB
-
MD5
3394aa9dfb48e470547e7f8628375edc
-
SHA1
61a0e1e57a660aebdb36db1a27af1455370d6510
-
SHA256
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210
-
SHA512
6faf184af17608b71fd5bc5a4a0d50b3649d53647acea4aee52a18696fdc77aa8c85bed55281e27dbb395eefcf2db7a92b5be5b7389f69d9d517c11338a62fcc
-
SSDEEP
49152:ZqCY2nf4AUBeTNQqw/H2a2fidVEtMoo9SSwMKJrEmzuZWj7T:Exqf1pdw/bD8OkXcE
Malware Config
Extracted
lokibot
https://sempersim.su/a21/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe"C:\Users\Admin\AppData\Local\Temp\b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp425A.tmp.bat""2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force4⤵
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"4⤵
-
-
C:\Windows\SysWOW64\ping.exe"C:\Windows\SYSWOW64\ping.exe"4⤵
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD59d68f73019fb6bc62b1d167d44ecb178
SHA177f7861ff96d5bf9d4c5540f7aa6112546ba6109
SHA2562eaca6a028bbefb9cbb8dbbed517fc09ed569fc8653e60cdcb1ae47ec0ff2d17
SHA512c67e5edc7fc9147d49859b2f04298198fe078e51bccd25373bc976e5ea95ae34dba2bce613cd534c919b3153fbf5ee9b648d028e9c0fbc6f9c19db6cd813139a
-
Filesize
1.3MB
MD511fe83e3c37b76d520f13c46b92f0e6f
SHA11fe5b0de1cb83737bc4c6addca1df46207a1e93d
SHA256c202587e581136d8af2ffde4d6d363c7a10e394bb2a8f7d4825a6b9d8f18f409
SHA51208a964886113030bb36c74d273991a75f89ca645cf600ccf955a7476f306593bd42efdd344e1de6fbeef84f71aa1aff60742f9f9ac0c49504b643358770845c9
-
Filesize
830KB
MD5a1ec4de1cee6c1cb27ec088f8f73f7d6
SHA17d636c0c2c4b8d601cd328762d0f9d3b3fd72de2
SHA256a5ca01f9287b656874816b63b6d47ca9fdd64590e30c9d668806a1b43d173dcc
SHA5126799d6d4cb06362ecc78f4f2cb74f8cba72c6786b25a17ea950c218b966c8c2c34db5aeff8a31bf69c99e3b8da8a3b939d9c170c1421f3b6dbee6a8bf6e8ed61
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
416KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.2MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
136KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
7.7MB
-
Filesize
7.7MB