Analysis
- max time kernel
97s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/11/2024, 03:34
General
- Target d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe
- Size 506KB
- Sample241120-d449as1arn
- SHA256 d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca
Malware Config
Extracted
-
lokibot
-
http://94.156.177.41/maxzi/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Lokibot family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe"C:\Users\Admin\AppData\Local\Temp\d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe"C:\Users\Admin\AppData\Local\Temp\d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wnsjlmpm.om4.ps1
0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f
0f5007522459c86e95ffcc62f32308f1_cca0d105-8260-4611-8c12-bd85a7208b9f
memory/508-73-0x0000000007850000-0x000000000786A000-memory.dmp
memory/508-20-0x0000000005680000-0x0000000005CA8000-memory.dmp
memory/508-85-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-82-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-81-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
memory/508-80-0x0000000007B70000-0x0000000007B78000-memory.dmp
memory/508-79-0x0000000007B90000-0x0000000007BAA000-memory.dmp
memory/508-77-0x0000000007A80000-0x0000000007A8E000-memory.dmp
memory/508-76-0x0000000007A50000-0x0000000007A61000-memory.dmp
memory/508-75-0x0000000007AD0000-0x0000000007B66000-memory.dmp
memory/508-74-0x00000000078C0000-0x00000000078CA000-memory.dmp
memory/508-72-0x0000000007EA0000-0x000000000851A000-memory.dmp
memory/508-17-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
memory/508-18-0x0000000004EE0000-0x0000000004F16000-memory.dmp
memory/508-19-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-38-0x0000000006520000-0x000000000656C000-memory.dmp
memory/508-21-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-23-0x0000000005480000-0x00000000054E6000-memory.dmp
memory/508-22-0x00000000053E0000-0x0000000005402000-memory.dmp
memory/508-24-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/508-71-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-30-0x0000000005E70000-0x00000000061C4000-memory.dmp
memory/508-70-0x0000000007730000-0x00000000077D3000-memory.dmp
memory/508-35-0x00000000064F0000-0x000000000650E000-memory.dmp
memory/508-78-0x0000000007A90000-0x0000000007AA4000-memory.dmp
memory/508-56-0x00000000076F0000-0x0000000007722000-memory.dmp
memory/508-58-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/508-59-0x00000000707E0000-0x000000007082C000-memory.dmp
memory/508-69-0x0000000006AC0000-0x0000000006ADE000-memory.dmp
memory/2964-15-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2964-92-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2964-11-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2964-55-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2964-13-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/4884-2-0x0000000005E70000-0x0000000006414000-memory.dmp
memory/4884-0-0x0000000074AFE000-0x0000000074AFF000-memory.dmp
memory/4884-16-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/4884-3-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/4884-10-0x0000000006E40000-0x0000000006EA4000-memory.dmp
memory/4884-9-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/4884-8-0x0000000005A70000-0x0000000005A82000-memory.dmp
memory/4884-7-0x0000000074AFE000-0x0000000074AFF000-memory.dmp
memory/4884-6-0x0000000074AF0000-0x00000000752A0000-memory.dmp
memory/4884-5-0x0000000005A80000-0x0000000005B1C000-memory.dmp
memory/4884-1-0x0000000000E90000-0x0000000000F14000-memory.dmp
memory/4884-4-0x00000000057D0000-0x00000000057DA000-memory.dmp