Analysis

  • max time kernel
    121s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-06-2024 09:10

General

  • Target

    97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe

  • Size

    238KB

  • MD5

    97b4a9daae17f222e74bf29cb17cb993

  • SHA1

    f54f977ef4caff7db6876111a2b910c3b0a3200c

  • SHA256

    68942496e531806f99429c1ab642461aa0e25d0046b9bb508d83c36fa72e6bf5

  • SHA512

    f05f2b4c4e783daa51d3e9370b659df6987af8034995e9dd1435d6c1912807fc6ec6c3029d4fe366941dc1a8c9a694ed3a7b3bee266d13e4cc8ef4d90c30736d

  • SSDEEP

    6144:nKpiZHDCvlpsreLv4u5WRFTf9d7LuMet2f0RF3V:nKpiZH+l4UWHfL7ad2f0RN

Malware Config

Extracted

Family

lokibot

C2

http://geranntibankasi.com/corp/nel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:292
    • C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe"
      2⤵
        PID:1580
      • C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2560

    Network

    • flag-us
      DNS
      geranntibankasi.com
      97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      geranntibankasi.com
      IN A
      Response
    No results found
    • 8.8.8.8:53
      geranntibankasi.com
      dns
      97b4a9daae17f222e74bf29cb17cb993_JaffaCakes118.exe
      65 B
      138 B
      1
      1

      DNS Request

      geranntibankasi.com

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

      Filesize

      46B

      MD5

      d898504a722bff1524134c6ab6a5eaa5

      SHA1

      e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

      SHA256

      878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

      SHA512

      26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

      Filesize

      46B

      MD5

      c07225d4e7d01d31042965f048728a0a

      SHA1

      69d70b340fd9f44c89adb9a2278df84faa9906b7

      SHA256

      8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

      SHA512

      23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    • memory/292-0-0x000000007494E000-0x000000007494F000-memory.dmp

      Filesize

      4KB

    • memory/292-1-0x0000000001230000-0x0000000001272000-memory.dmp

      Filesize

      264KB

    • memory/292-2-0x00000000009A0000-0x00000000009E2000-memory.dmp

      Filesize

      264KB

    • memory/292-3-0x00000000004F0000-0x00000000004FA000-memory.dmp

      Filesize

      40KB

    • memory/292-4-0x0000000074940000-0x000000007502E000-memory.dmp

      Filesize

      6.9MB

    • memory/292-16-0x0000000074940000-0x000000007502E000-memory.dmp

      Filesize

      6.9MB

    • memory/2560-6-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-12-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-15-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-14-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2560-9-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-7-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-8-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-5-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/2560-58-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.