Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    30/03/2024, 17:07

General

  • Target

    404fdb1ce192f8274a78ceec928256f7_JaffaCakes118.exe

  • Size

    642KB

  • MD5

    404fdb1ce192f8274a78ceec928256f7

  • SHA1

    a2e9e1c42e2d83e5ebcc37d68895deebd648b57a

  • SHA256

    ddedd1eb01aa4a575922cf3ffb033cc8f5829db70dd713d33cc1ebf4a6347d29

  • SHA512

    2dd4a4fae477e0683e2aab44dc40784fc26756d07df9887511ce3eda0d7413e156d5de062fd5f6d4a874b604242022e772829d410caea7878517beab6ab5a4a8

  • SSDEEP

    6144:y4XhteQBOpJPRwjQkuaRBMyJp3RaQLqsffbvlIOvKGgBdUhcX7elbKTumLnyuIIO:frBZztMOp33LrRUBd3X3uIIIkIxV0DT

Malware Config

Extracted

Family

lokibot

C2

http://37.0.10.190/300/n2/pin.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\404fdb1ce192f8274a78ceec928256f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\404fdb1ce192f8274a78ceec928256f7_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\404fdb1ce192f8274a78ceec928256f7_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\404fdb1ce192f8274a78ceec928256f7_JaffaCakes118.exe"
      2⤵
        PID:2220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 768
        2⤵
        • Program crash
        PID:2216

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1568-0-0x00000000011B0000-0x0000000001256000-memory.dmp

      Filesize

      664KB

    • memory/1568-1-0x00000000744B0000-0x0000000074B9E000-memory.dmp

      Filesize

      6.9MB

    • memory/1568-2-0x0000000004F90000-0x0000000004FD0000-memory.dmp

      Filesize

      256KB

    • memory/1568-17-0x00000000744B0000-0x0000000074B9E000-memory.dmp

      Filesize

      6.9MB

    • memory/1568-18-0x0000000004F90000-0x0000000004FD0000-memory.dmp

      Filesize

      256KB

    • memory/2220-3-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB

    • memory/2220-5-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB

    • memory/2220-6-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB

    • memory/2220-8-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB

    • memory/2220-10-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB

    • memory/2220-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2220-15-0x0000000000070000-0x0000000000112000-memory.dmp

      Filesize

      648KB