Analysis
- max time kernel
21s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 03:09
General
- Target f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe
- Size 584KB
- Sample240607-dnrm9shg82
- SHA256 f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8
Malware Config
Extracted
-
lokibot
-
http://sempersim.su/d1/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs
- Detects executables containing common artifacts observed in infostealers 4 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe"C:\Users\Admin\AppData\Local\Temp\f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BmsytiGlrkcmB.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BmsytiGlrkcmB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp99EE.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe"C:\Users\Admin\AppData\Local\Temp\f06d778eb278b9611ef39826907f9e083fb392e90fb313a9549d3b67971b1ae8.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_wpw0q2wu.x4i.ps1
tmp99EE.tmp
0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90
0f5007522459c86e95ffcc62f32308f1_39fbc0df-d496-4ae0-b1d7-bde60e245d90
memory/1192-4-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1192-47-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1192-7-0x0000000005F90000-0x0000000005F9E000-memory.dmp
memory/1192-9-0x0000000006B70000-0x0000000006BD2000-memory.dmp
memory/1192-10-0x0000000006E00000-0x0000000006E9C000-memory.dmp
memory/1192-6-0x0000000005AA0000-0x0000000005AB6000-memory.dmp
memory/1192-16-0x000000007492E000-0x000000007492F000-memory.dmp
memory/1192-8-0x0000000005FA0000-0x0000000005FB0000-memory.dmp
memory/1192-5-0x0000000005980000-0x000000000598A000-memory.dmp
memory/1192-3-0x00000000058C0000-0x0000000005952000-memory.dmp
memory/1192-2-0x0000000005FB0000-0x0000000006554000-memory.dmp
memory/1192-0-0x000000007492E000-0x000000007492F000-memory.dmp
memory/1192-1-0x0000000000E50000-0x0000000000EE8000-memory.dmp
memory/1192-30-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/3188-83-0x0000000007B70000-0x0000000007C06000-memory.dmp
memory/3188-79-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/3188-46-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/3188-52-0x00000000065B0000-0x00000000065CE000-memory.dmp
memory/3188-53-0x00000000065E0000-0x000000000662C000-memory.dmp
memory/3188-55-0x00000000751B0000-0x00000000751FC000-memory.dmp
memory/3188-28-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/3188-84-0x0000000007AF0000-0x0000000007B01000-memory.dmp
memory/3188-95-0x0000000007B30000-0x0000000007B44000-memory.dmp
memory/3188-51-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/3188-103-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/3188-88-0x0000000007B20000-0x0000000007B2E000-memory.dmp
memory/3188-96-0x0000000007C30000-0x0000000007C4A000-memory.dmp
memory/3188-81-0x0000000007F70000-0x00000000085EA000-memory.dmp
memory/3188-66-0x0000000006B80000-0x0000000006B9E000-memory.dmp
memory/3188-54-0x0000000006BA0000-0x0000000006BD2000-memory.dmp
memory/3616-25-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3616-111-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3616-119-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/3616-26-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4944-22-0x00000000053D0000-0x0000000005436000-memory.dmp
memory/4944-80-0x0000000006DC0000-0x0000000006DDA000-memory.dmp
memory/4944-82-0x0000000006E30000-0x0000000006E3A000-memory.dmp
memory/4944-97-0x00000000070E0000-0x00000000070E8000-memory.dmp
memory/4944-57-0x00000000751B0000-0x00000000751FC000-memory.dmp
memory/4944-17-0x0000000004D00000-0x0000000005328000-memory.dmp
memory/4944-104-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/4944-21-0x0000000005330000-0x0000000005352000-memory.dmp
memory/4944-23-0x0000000005440000-0x00000000054A6000-memory.dmp
memory/4944-19-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/4944-18-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/4944-24-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/4944-15-0x0000000000D00000-0x0000000000D36000-memory.dmp
memory/4944-27-0x00000000054B0000-0x0000000005804000-memory.dmp