Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 17:43
General
- Target eba2a39642c4b7ce44b43e04056633e8_JaffaCakes118.exe
- Size 603KB
- Sample240410-wasyaaac61
- SHA256 dfbddd593573d22f463ddb6d75e59aa37dae2b7c130d81fb7a79c57457d7cab8
Malware Config
Extracted
-
lokibot
-
http://pualofficelogs.xyz/gg/bb/yes.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eba2a39642c4b7ce44b43e04056633e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eba2a39642c4b7ce44b43e04056633e8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe
0f5007522459c86e95ffcc62f32308f1_571594ad-b717-4cea-93ae-747ab327a92a
0f5007522459c86e95ffcc62f32308f1_571594ad-b717-4cea-93ae-747ab327a92a
memory/2820-12-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2820-15-0x0000000006B40000-0x0000000006B54000-memory.dmp
memory/2820-5-0x00000000052A0000-0x000000000533C000-memory.dmp
memory/2820-6-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2820-7-0x0000000005400000-0x0000000005428000-memory.dmp
memory/2820-8-0x00000000068F0000-0x0000000006956000-memory.dmp
memory/2820-9-0x00000000068B0000-0x00000000068D2000-memory.dmp
memory/2820-10-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2820-11-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/2820-0-0x0000000000290000-0x000000000032E000-memory.dmp
memory/2820-13-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2820-4-0x0000000004E80000-0x00000000051D4000-memory.dmp
memory/2820-16-0x0000000009660000-0x0000000009666000-memory.dmp
memory/2820-1-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/2820-3-0x0000000004D40000-0x0000000004DD2000-memory.dmp
memory/2820-2-0x0000000005430000-0x00000000059D4000-memory.dmp
memory/2820-23-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/5088-24-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/5088-22-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/5088-18-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/5088-67-0x0000000000400000-0x00000000004A2000-memory.dmp