Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 15:28

General

  • Target

    9244b2d494d5ad3599c1052e8417e78c_JaffaCakes118.exe

  • Size

    340KB

  • MD5

    9244b2d494d5ad3599c1052e8417e78c

  • SHA1

    58cfd91f8df838fba31fdcc50b9348eeffa4f8e6

  • SHA256

    0b1449ba67b485208d78e5301f375ab07149276e7fe451faf3e367f8fdb1f749

  • SHA512

    65793b0e8fe65ae640391f8b371750984944a890a3278be3f2ceef856ebde877173ae870b735ce53b654c93e9380c1eec76e1bdd7faa4e490615a4e3f0a710c8

  • SSDEEP

    6144:IJw3DINz83FF48esROy5ICT1pfzBwV7d:I4IZ874J1CnbBc7d

Malware Config

Extracted

Family

lokibot

C2

http://augtosyt.ru/vinedoe/fred.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9244b2d494d5ad3599c1052e8417e78c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9244b2d494d5ad3599c1052e8417e78c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Update\wogh.exe" /XML "C:\Users\Admin\AppData\Local\Temp\z24"
      2⤵
      • Creates scheduled task(s)
      PID:2948
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2616

Network

  • flag-us
    DNS
    augtosyt.ru
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    augtosyt.ru
    IN A
    Response
No results found
  • 8.8.8.8:53
    augtosyt.ru
    dns
    RegAsm.exe
    57 B
    118 B
    1
    1

    DNS Request

    augtosyt.ru

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\z24

    Filesize

    1KB

    MD5

    f5d9ccaa3ab88af08b46ef65f7c5a0dd

    SHA1

    df0ca4c87141c0b5117509e3251ec95e40a36cd5

    SHA256

    8e9b96f4aa97735b15ccac20d758f5c966e1d3dac10997a6315ef775be285c42

    SHA512

    f98c0b13d19ab507fd69abcbfe7ea2dfcc621b167618c0401732c5dcde96ad89fc6108b156441ad7b848874930770675cbec4fbd84a3d0e47a1ae97dfa1645f5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41e

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41e

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • memory/2184-0-0x0000000074781000-0x0000000074782000-memory.dmp

    Filesize

    4KB

  • memory/2184-1-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2184-2-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2184-26-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2616-8-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-25-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2616-19-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-16-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-6-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-24-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-30-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-10-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-13-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2616-71-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.