Analysis
- max time kernel
1s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 19:32
General
- Target 4992f84319970e733d168e6ad773a004.exe
- Size 576KB
- Sample240107-x9ck1sdeb2
- SHA256 18a0f81301bf191cb94219522948580bb2036c5025e3a723fdd6fe353d840b01
Malware Config
Extracted
-
lokibot
-
http://65.21.223.84/~t/i.html/mxnW4pqpedfLr
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Detect ZGRat V1 7 IoCs
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- ZGRat
ZGRat is remote access trojan written in C#.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\4992f84319970e733d168e6ad773a004.exe"C:\Users\Admin\AppData\Local\Temp\4992f84319970e733d168e6ad773a004.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4992f84319970e733d168e6ad773a004.exeC:\Users\Admin\AppData\Local\Temp\4992f84319970e733d168e6ad773a004.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0f5007522459c86e95ffcc62f32308f1_5e7ac5ce-f825-4b7f-a513-df181efdae1c
0f5007522459c86e95ffcc62f32308f1_5e7ac5ce-f825-4b7f-a513-df181efdae1c
memory/544-57-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-92-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-5-0x0000000005A80000-0x0000000005A8A000-memory.dmp
memory/544-0-0x0000000000E40000-0x0000000000ED6000-memory.dmp
memory/544-2-0x0000000005DC0000-0x0000000006364000-memory.dmp
memory/544-3-0x00000000058C0000-0x0000000005952000-memory.dmp
memory/544-2452-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/544-2444-0x0000000007A10000-0x0000000007A2E000-memory.dmp
memory/544-36-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-37-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-39-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-41-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-43-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-45-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-49-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-51-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-53-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-93-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-29-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/544-55-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-1-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/544-59-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-61-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-35-0x0000000006BE0000-0x0000000006C46000-memory.dmp
memory/544-47-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-71-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-89-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-90-0x0000000006CD0000-0x0000000006D46000-memory.dmp
memory/544-91-0x0000000007050000-0x00000000070C0000-memory.dmp
memory/544-101-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-99-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-97-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-4-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/544-95-0x0000000007050000-0x00000000070BB000-memory.dmp
memory/544-63-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-87-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-85-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-83-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-81-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-79-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-77-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-75-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-73-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-69-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-67-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/544-65-0x0000000006BE0000-0x0000000006C41000-memory.dmp
memory/3104-2453-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3104-2463-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3444-25-0x0000000006300000-0x000000000634C000-memory.dmp
memory/3444-7-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/3444-30-0x0000000008710000-0x0000000008D8A000-memory.dmp
memory/3444-27-0x00000000067A0000-0x00000000067BA000-memory.dmp
memory/3444-28-0x00000000067F0000-0x0000000006812000-memory.dmp
memory/3444-6-0x0000000004D80000-0x0000000004DB6000-memory.dmp
memory/3444-24-0x00000000062B0000-0x00000000062CE000-memory.dmp
memory/3444-26-0x0000000007490000-0x0000000007526000-memory.dmp
memory/3444-8-0x0000000004D70000-0x0000000004D80000-memory.dmp
memory/3444-31-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/3444-11-0x0000000005320000-0x0000000005342000-memory.dmp
memory/3444-12-0x0000000005A20000-0x0000000005A86000-memory.dmp
memory/3444-23-0x0000000005DF0000-0x0000000006144000-memory.dmp
memory/3444-2447-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/3444-14-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/3444-33-0x0000000004D70000-0x0000000004D80000-memory.dmp
memory/3444-34-0x0000000004D70000-0x0000000004D80000-memory.dmp
memory/3444-10-0x00000000053F0000-0x0000000005A18000-memory.dmp
memory/3444-9-0x0000000004D70000-0x0000000004D80000-memory.dmp