Analysis
- max time kernel
146s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/06/2024, 01:39
General
- Target 9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7.exe
- Size 573KB
- Sample240601-b3c3badc7t
- SHA256 9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7
Malware Config
Extracted
-
lokibot
-
http://45.61.137.215/index.php/t?id=090
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
- Detects executables containing common artifacts observed in infostealers 5 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7.exe"C:\Users\Admin\AppData\Local\Temp\9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7.exe"C:\Users\Admin\AppData\Local\Temp\9b1a701176e76825bc886d067194fc7aa514c5cbffb63c039d62154c5b9d3ac7.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
memory/3464-10-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3464-42-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3464-34-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3464-14-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3464-12-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4412-4-0x00000000049E0000-0x00000000049EA000-memory.dmp
memory/4412-8-0x0000000005DA0000-0x0000000005E02000-memory.dmp
memory/4412-9-0x00000000086C0000-0x000000000875C000-memory.dmp
memory/4412-7-0x0000000005B80000-0x0000000005B90000-memory.dmp
memory/4412-6-0x00000000073F0000-0x0000000007408000-memory.dmp
memory/4412-5-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4412-15-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/4412-0-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/4412-3-0x0000000004A20000-0x0000000004AB2000-memory.dmp
memory/4412-2-0x0000000004FD0000-0x0000000005574000-memory.dmp
memory/4412-1-0x00000000000B0000-0x0000000000140000-memory.dmp