Analysis
- max time kernel
126s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 22:30
General
- Target DOC222.exe
- Size 490KB
- Sample240326-2e4s8sha9t
- SHA256 454e87da084f762d25dcb7858795f6bb6cd549cc0f1435177121b0eb66c17743
Malware Config
Extracted
-
lokibot
-
https://sempersim.su/c16/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC222.exe"C:\Users\Admin\AppData\Local\Temp\DOC222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DOC222.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gmLDcEXOxYt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gmLDcEXOxYt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC96A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DOC222.exe"C:\Users\Admin\AppData\Local\Temp\DOC222.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5nprnehm.3k0.ps1
tmpC96A.tmp
0f5007522459c86e95ffcc62f32308f1_5baa2aac-6f09-498d-a5a6-e1e70cf8ebe4
0f5007522459c86e95ffcc62f32308f1_5baa2aac-6f09-498d-a5a6-e1e70cf8ebe4
memory/1752-86-0x0000000005450000-0x000000000546A000-memory.dmp
memory/1752-61-0x00000000754E0000-0x000000007552C000-memory.dmp
memory/1752-55-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1752-103-0x00000000079F0000-0x00000000079F8000-memory.dmp
memory/1752-102-0x0000000007A00000-0x0000000007A1A000-memory.dmp
memory/1752-101-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1752-97-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/1752-17-0x0000000005140000-0x0000000005176000-memory.dmp
memory/1752-18-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1752-19-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1752-20-0x0000000005880000-0x0000000005EA8000-memory.dmp
memory/1752-87-0x0000000007AA0000-0x0000000007AAA000-memory.dmp
memory/1752-85-0x0000000008060000-0x00000000086DA000-memory.dmp
memory/1752-84-0x0000000007900000-0x00000000079A3000-memory.dmp
memory/1752-73-0x0000000006CC0000-0x0000000006CDE000-memory.dmp
memory/1752-69-0x000000007F9A0000-0x000000007F9B0000-memory.dmp
memory/1752-109-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/3276-99-0x0000000007D40000-0x0000000007D4E000-memory.dmp
memory/3276-100-0x0000000007D50000-0x0000000007D64000-memory.dmp
memory/3276-56-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3276-47-0x00000000061E0000-0x0000000006534000-memory.dmp
memory/3276-27-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/3276-21-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/3276-98-0x0000000007D10000-0x0000000007D21000-memory.dmp
memory/3276-53-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/3276-54-0x0000000006D30000-0x0000000006D7C000-memory.dmp
memory/3276-23-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3276-26-0x0000000005F50000-0x0000000005FB6000-memory.dmp
memory/3276-22-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3276-60-0x00000000077B0000-0x00000000077E2000-memory.dmp
memory/3276-25-0x0000000005800000-0x0000000005822000-memory.dmp
memory/3276-74-0x00000000754E0000-0x000000007552C000-memory.dmp
memory/3276-110-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/3276-62-0x000000007EEC0000-0x000000007EED0000-memory.dmp
memory/3692-51-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3692-50-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3692-117-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3692-125-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3692-46-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4860-7-0x0000000006320000-0x0000000006328000-memory.dmp
memory/4860-16-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/4860-0-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4860-11-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4860-10-0x0000000008F20000-0x0000000008FBC000-memory.dmp
memory/4860-9-0x0000000006900000-0x0000000006962000-memory.dmp
memory/4860-4-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/4860-3-0x00000000051A0000-0x0000000005232000-memory.dmp
memory/4860-8-0x0000000006450000-0x000000000645C000-memory.dmp
memory/4860-6-0x00000000068E0000-0x00000000068F6000-memory.dmp
memory/4860-2-0x0000000005750000-0x0000000005CF4000-memory.dmp
memory/4860-1-0x0000000000620000-0x00000000006A0000-memory.dmp
memory/4860-5-0x0000000005180000-0x000000000518A000-memory.dmp
memory/4860-52-0x0000000074C70000-0x0000000075420000-memory.dmp