Analysis

  • max time kernel
    94s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 21:01

General

  • Target

    3113c2a7b30c1cb350e8950b4222b0c4.exe

  • Size

    361KB

  • MD5

    3113c2a7b30c1cb350e8950b4222b0c4

  • SHA1

    2fe0c50dd095a738788693e147c0b9d883554d2c

  • SHA256

    7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6

  • SHA512

    4287e194b702492c3b0c960fc4a0cc1625607789e382b88276eaa9749f3ff32f38cf81da3543601cd1f9e2704366385962f421568702bb72a621cddf77aa58cd

  • SSDEEP

    6144:MHM3730X5T4avIrevXJZzkhq8R8ahdMSM9C/JWJu0GTY8odnR1j3hfbJHtFy7tcQ:p3cT4Ed3YQG8SM9LJV3dnRLbJHtFy7tJ

Malware Config

Extracted

Family

lokibot

C2

https://tequilacofradiamx.com/minyhug/fxgsfhsdtytdjfudyjfjewrwsejyt/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
    "C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
      C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
      2⤵
        PID:1836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 80
          3⤵
          • Program crash
          PID:1936
      • C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
        C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
        2⤵
          PID:4008
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 80
            3⤵
            • Program crash
            PID:216
        • C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
          C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:3492
        • C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
          C:\Users\Admin\AppData\Local\Temp\3113c2a7b30c1cb350e8950b4222b0c4.exe
          2⤵
            PID:2524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1836 -ip 1836
          1⤵
            PID:3784
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4008 -ip 4008
            1⤵
              PID:4320

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Collection

            Data from Local System

            1
            T1005

            Email Collection

            1
            T1114

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1836-3-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/2388-0-0x0000000074E80000-0x0000000075431000-memory.dmp
              Filesize

              5.7MB

            • memory/2388-1-0x0000000074E80000-0x0000000075431000-memory.dmp
              Filesize

              5.7MB

            • memory/2388-2-0x00000000017F0000-0x0000000001800000-memory.dmp
              Filesize

              64KB

            • memory/2388-13-0x0000000074E80000-0x0000000075431000-memory.dmp
              Filesize

              5.7MB

            • memory/2524-14-0x0000000000400000-0x00000000004A2000-memory.dmp
              Filesize

              648KB

            • memory/3492-5-0x0000000000400000-0x00000000004A2000-memory.dmp
              Filesize

              648KB

            • memory/3492-8-0x0000000000400000-0x00000000004A2000-memory.dmp
              Filesize

              648KB

            • memory/3492-11-0x0000000000400000-0x00000000004A2000-memory.dmp
              Filesize

              648KB

            • memory/3492-29-0x0000000000400000-0x00000000004A2000-memory.dmp
              Filesize

              648KB