Analysis

  • max time kernel
    144s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-06-2024 02:52

General

  • Target

    9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe

  • Size

    572KB

  • MD5

    9709f50a725cf56ed9440aed0c5a6547

  • SHA1

    1e0d3dc5f49bc0b28c8b9e2812280e37f36d6c26

  • SHA256

    52f74be7d47136ad913771c585d0cc07660eca16caa2d86a26ffbbb4e1908eb6

  • SHA512

    a73127bad51180318c85851491ce43cdc26eff38d64770c102b39130a4bf56f06bfad0cd5724aa83d25da1214f50fd3a75286d5218b2fff40195e403ea5f9ee2

  • SSDEEP

    12288:Phv5FVuKKkWAlZ39OBm53CpgNTDNjqeE:PhIIW2tESCpgFZqeE

Malware Config

Extracted

Family

lokibot

C2

http://despep.cf/h1/chikanew/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2888

Network

  • flag-us
    DNS
    despep.cf
    9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    despep.cf
    IN A
    Response
No results found
  • 8.8.8.8:53
    despep.cf
    dns
    9709f50a725cf56ed9440aed0c5a6547_JaffaCakes118.exe
    55 B
    114 B
    1
    1

    DNS Request

    despep.cf

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • C:\Windows\win.ini

    Filesize

    1KB

    MD5

    d23be30ee0944cb2e4dd6cd6e04a6d26

    SHA1

    c5a5220081d2c478a12eb6026af5c0819a0e85e0

    SHA256

    67e3b447fd1226539c1dc2977cb73ee62bd2b016e75d0cab3e80f893e20428e4

    SHA512

    bb909a808264730f9764f88d8facc88bd2a3cf260efbd24f42ea740f1bb6b8b99be8e1054139d84a485fad132dcd26d08127cf0793f6e7ff5766b11d87a96f2f

  • memory/1732-4-0x0000000077241000-0x0000000077342000-memory.dmp

    Filesize

    1.0MB

  • memory/1732-5-0x0000000077240000-0x00000000773E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2888-12-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2888-14-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2888-15-0x0000000077240000-0x00000000773E9000-memory.dmp

    Filesize

    1.7MB

  • memory/2888-51-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2924-11-0x0000000077240000-0x00000000773E9000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.