Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 01:04

General

  • Target

    120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe

  • Size

    475KB

  • MD5

    ef7dcebf0a73f49ded7f17ba4b3c1597

  • SHA1

    e2f6a9664fe8b53e82932491a963f3b3a15dc8a1

  • SHA256

    120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a

  • SHA512

    79dd1d828effff5953d497405b009da0298215975aa2790eb9c9d2d519f9ff34cdb8b9f4634be82fd107b9b9bd9bce299334deba2e338cb0f2d78b9c044fcc23

  • SSDEEP

    6144:8ApnvFMLzuP4RAu1icAp9/7ZxWgwxahXL92z2D8eYqzwcbL+6MyryXpZ+UnS1GKf:8kxwwJxWdahRg2ZHq6Myry1WQwLX

Malware Config

Extracted

Family

lokibot

C2

http://spencerstuartllc.top/evie2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
    "C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
      "C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe"
      2⤵
        PID:2332

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1880-0-0x000000007489E000-0x000000007489F000-memory.dmp

      Filesize

      4KB

    • memory/1880-1-0x0000000000510000-0x000000000058E000-memory.dmp

      Filesize

      504KB

    • memory/1880-2-0x0000000004F00000-0x0000000004F4E000-memory.dmp

      Filesize

      312KB

    • memory/1880-3-0x0000000005620000-0x0000000005BC4000-memory.dmp

      Filesize

      5.6MB

    • memory/1880-5-0x00000000051B0000-0x000000000524C000-memory.dmp

      Filesize

      624KB

    • memory/1880-4-0x0000000005110000-0x00000000051A2000-memory.dmp

      Filesize

      584KB

    • memory/1880-12-0x0000000074890000-0x0000000075040000-memory.dmp

      Filesize

      7.7MB

    • memory/1880-11-0x0000000074890000-0x0000000075040000-memory.dmp

      Filesize

      7.7MB

    • memory/1880-6-0x0000000005000000-0x0000000005008000-memory.dmp

      Filesize

      32KB

    • memory/2332-8-0x0000000000700000-0x00000000007A2000-memory.dmp

      Filesize

      648KB