Overview

overview

10

Static

static

3

FedEX Arri...63.exe

windows7-x64

7

FedEX Arri...63.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    94s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FedEX Arrival - AWB# 102235508763.exe
  • Size 522KB
  • Sample240815-e3nqlazcjl
  • SHA256 04bcf38fe795bd3884ba28e2b28d7848cdaf880b057d9d8263629901220fdf7f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

  • lokibot

C2

  • http://104.248.205.66/index.php/wp?edit=92441867177748

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Loads dropped DLL 7 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe
    "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Program Files (x86)\windows mail\wab.exe
      "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
      2⤵
        PID:940
      • C:\Program Files (x86)\windows mail\wab.exe
        "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
        2⤵
          PID:3768
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
          2⤵
            PID:464
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
            2⤵
              PID:4056
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
              2⤵
                PID:4896
              • C:\Program Files (x86)\windows mail\wab.exe
                "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                2⤵
                  PID:4964
                • C:\Program Files (x86)\windows mail\wab.exe
                  "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                  2⤵
                    PID:3788
                  • C:\Program Files (x86)\windows mail\wab.exe
                    "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                    2⤵
                      PID:2976
                    • C:\Program Files (x86)\windows mail\wab.exe
                      "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                      2⤵
                        PID:3212
                      • C:\Program Files (x86)\windows mail\wab.exe
                        "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                        2⤵
                          PID:1036
                        • C:\Program Files (x86)\windows mail\wab.exe
                          "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                          2⤵
                            PID:2456
                          • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                            "C:\Users\Admin\AppData\Local\Temp\FedEX Arrival - AWB# 102235508763.exe"
                            2⤵
                            • Accesses Microsoft Outlook profiles
                            • Suspicious use of NtCreateThreadExHideFromDebugger
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • outlook_office_path
                            • outlook_win_path
                            PID:4212

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              LangDLL.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nst8212.tmp\LangDLL.dll
                              • Size 5KB
                              • SHA256 92cb3b3a7280246743543325d3fe9a7d72c63227f9540d25d5ef27b2ce8856b4
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              System.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nst8212.tmp\System.dll
                              • Size 12KB
                              • SHA256 1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              strikkernes.lnk
                              • Path C:\Users\Admin\strikkernes.lnk
                              • Size 942B
                              • SHA256 d66eab269fc86857380eb61d495d504b3db341276091edcf902e7e49074e9295
                              • MD5 SHA1 SHA512
                              Submit Download

                              memory/1616-34-0x00000000777A1000-0x00000000778C1000-memory.dmp
                              Download

                              memory/1616-35-0x0000000074605000-0x0000000074606000-memory.dmp
                              Download

                              memory/1616-36-0x0000000074600000-0x0000000074607000-memory.dmp
                              Download

                              memory/4212-37-0x0000000077828000-0x0000000077829000-memory.dmp
                              Download

                              memory/4212-38-0x0000000077845000-0x0000000077846000-memory.dmp
                              Download

                              memory/4212-39-0x0000000000400000-0x00000000005E4000-memory.dmp
                              Download

                              memory/4212-45-0x0000000000400000-0x00000000005E4000-memory.dmp
                              Download

                              memory/4212-46-0x00000000777A1000-0x00000000778C1000-memory.dmp
                              Download