Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 01:35

General

  • Target

    7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe

  • Size

    361KB

  • MD5

    3113c2a7b30c1cb350e8950b4222b0c4

  • SHA1

    2fe0c50dd095a738788693e147c0b9d883554d2c

  • SHA256

    7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6

  • SHA512

    4287e194b702492c3b0c960fc4a0cc1625607789e382b88276eaa9749f3ff32f38cf81da3543601cd1f9e2704366385962f421568702bb72a621cddf77aa58cd

  • SSDEEP

    6144:MHM3730X5T4avIrevXJZzkhq8R8ahdMSM9C/JWJu0GTY8odnR1j3hfbJHtFy7tcQ:p3cT4Ed3YQG8SM9LJV3dnRLbJHtFy7tJ

Malware Config

Extracted

Family

lokibot

C2

https://tequilacofradiamx.com/minyhug/fxgsfhsdtytdjfudyjfjewrwsejyt/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 7 IoCs
  • Detects executables containing common artifacts observed in infostealers 7 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
    "C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
      C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1216
    • C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
      C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
      2⤵
        PID:1124
      • C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
        C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
        2⤵
          PID:2424
        • C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
          C:\Users\Admin\AppData\Local\Temp\7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6.exe
          2⤵
            PID:2740

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1124-11-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1124-33-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1216-3-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1216-6-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1216-10-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1216-32-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/1712-0-0x0000000074580000-0x0000000074B2B000-memory.dmp
          Filesize

          5.7MB

        • memory/1712-1-0x0000000000B30000-0x0000000000B70000-memory.dmp
          Filesize

          256KB

        • memory/1712-2-0x0000000074580000-0x0000000074B2B000-memory.dmp
          Filesize

          5.7MB

        • memory/1712-19-0x0000000074580000-0x0000000074B2B000-memory.dmp
          Filesize

          5.7MB

        • memory/2424-17-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB

        • memory/2740-18-0x0000000000400000-0x00000000004A2000-memory.dmp
          Filesize

          648KB