Overview

overview

10

Static

static

1

2423f7f476...18.msi

windows7-x64

10

2423f7f476...18.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 09:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2423f7f4760abde3ea56dc0fe3c2ca64_JaffaCakes118.msi
  • Size 336KB
  • Sample240508-k2zdlafd78
  • SHA256 a4f95f33320c2520836f546c933cdb167943aa51e8ee7001f72e9adbaf442fe4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

  • lokibot

C2

  • http://www.crownventureintl.com/wip-admin/Panel/five/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2423f7f4760abde3ea56dc0fe3c2ca64_JaffaCakes118.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2240
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\Installer\MSI787D.tmp
      "C:\Windows\Installer\MSI787D.tmp"
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4268
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1292

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e577765.rbs
        • Path C:\Config.Msi\e577765.rbs
        • Size 663B
        • SHA256 cd2df6443dc22e18fd5a062d8d4d3c2bddc7f26591d5300f401790a4ce222d76
        • MD5 SHA1 SHA512
        Submit Download

        0f5007522459c86e95ffcc62f32308f1_702abe76-fde0-4134-943b-e0c6d24c5ee3
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3726321484-1950364574-433157660-1000\0f5007522459c86e95ffcc62f32308f1_702abe76-fde0-4134-943b-e0c6d24c5ee3
        • Size 46B
        • SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
        • MD5 SHA1 SHA512
        Submit Download

        0f5007522459c86e95ffcc62f32308f1_702abe76-fde0-4134-943b-e0c6d24c5ee3
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3726321484-1950364574-433157660-1000\0f5007522459c86e95ffcc62f32308f1_702abe76-fde0-4134-943b-e0c6d24c5ee3
        • Size 46B
        • SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
        • MD5 SHA1 SHA512
        Submit Download

        MSI787D.tmp
        • Path C:\Windows\Installer\MSI787D.tmp
        • Size 312KB
        • SHA256 234b350d9cb211ec3d444efa5c03bfa0c04a38cf2cd63bfa309b1ce88567f2b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 7690d3b4ab16861284d5b627446742c1b6995d84c80f6baa8eda367c777e0545
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {db65dba0-1d77-4dfc-8324-861a11d5d409}_OnDiskSnapshotProp
        • Path \??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{db65dba0-1d77-4dfc-8324-861a11d5d409}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 7dc67d83596de7b25be039418fa25d82a851deee7e314f8aabdef662d9cae410
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4268-14-0x0000000000400000-0x00000000004A2000-memory.dmp
        Download

        memory/4268-17-0x0000000000400000-0x00000000004A2000-memory.dmp
        Download