Analysis

  • max time kernel
    131s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 14:51

General

  • Target

    Pirkuma pas?t?jums_(PO40232)_LEAX Baltix SIA.exe

  • Size

    225KB

  • MD5

    9a5eb541f9df732ca5158c96cded4ae6

  • SHA1

    9dc7a4e784e7c9cad8eecaaba56bf43e14d30599

  • SHA256

    75173e92fd7a13e7be3ec177c5287280aae4d2a5e6911cd1458400d96289d18d

  • SHA512

    a1e71885ce4e9b05b4075bc8164151109f19b7a6f15cacc09d7c25159f079e584ef525dfd31ea431cc0cb8a93f8950e2614771f769f90769ef55e5f70eceb52f

  • SSDEEP

    3072:k9iIXdVtoSgo/GMEzLr+aTN1m1hN5P4h3ms3QEN+GNstgAMdjFTlN4l5jrVlWdL6:etWSg/Vr++ivxTEsGhAMRzN4nx

Malware Config

Extracted

Family

lokibot

C2

https://ddrtot.shop/MV3/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Lokibot family
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pirkuma pas_t_jums_(PO40232)_LEAX Baltix SIA.exe
    "C:\Users\Admin\AppData\Local\Temp\Pirkuma pas_t_jums_(PO40232)_LEAX Baltix SIA.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2796

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.208.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.208.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ddrtot.shop
    aspnet_compiler.exe
    Remote address:
    8.8.8.8:53
    Request
    ddrtot.shop
    IN A
    Response
    ddrtot.shop
    IN A
    172.67.192.176
    ddrtot.shop
    IN A
    104.21.73.230
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 358
    Connection: close
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    176.192.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.192.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    176.192.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.192.67.172.in-addr.arpa
    IN PTR
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 02 Dec 2024 14:51:21 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EAIZeO92Tr8CUJc5fGwQV%2FxWZPaGRbcu2uP9mpFRlbVNb7XCDPdso7Amu142PZ7%2BZ2hUVlusP%2FwzBteQBBZgZx%2Btkzb1Jt0s%2BQJwultzEZdtJkg6F4iDigy7mV%2BplQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ebc2271ae3894eb-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=58927&min_rtt=58927&rtt_var=29463&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=419&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 02 Dec 2024 14:51:22 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VI6mwq8bJyy8y7q8pQgHHf9xhoBDR5eBFvLVH%2FdqoNCflo4S7G5mNVKN66Ey4RakKWl1JrpdIHP7eMa%2BZ1%2BEAs1kVe6W3CeRbuNZgEGvwaxeMxYiAnRXKRFazGO0ng%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ebc22778c60f664-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=642573&min_rtt=642573&rtt_var=321286&sent=1&recv=2&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.181.100.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.181.100.95.in-addr.arpa
    IN PTR
    Response
    139.181.100.95.in-addr.arpa
    IN PTR
    a95-100-181-139deploystaticakamaitechnologiescom
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 02 Dec 2024 14:52:22 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8TRpX%2BGPpBrv5xFAdvcilUtPhQ%2FTqTllP3jh96tqWttGvvjG1VZOZkNbvD7igDzBPqrd7MUaJE4ymIsCaEW%2FOjY75uiguCH5zrCZ7ujVDtgF8Rl5W%2B%2F2W914J1c%2FDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ebc23f00cee955f-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=47519&min_rtt=47519&rtt_var=23759&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    100.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    100.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    http://ddrtot.shop/MV3/PWS/fre.php
    aspnet_compiler.exe
    Remote address:
    172.67.192.176:80
    Request
    POST /MV3/PWS/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: ddrtot.shop
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: E37FD2E8
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Mon, 02 Dec 2024 14:53:22 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: close
    Status: 404 Not Found
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=19Otd9ZRUWn97q4D8Uxu7yNF0Ra7ZX8JjqOFy4lcpVwx%2Bto7vYSaWH%2B7cOnHUF37YLbsewySSW0SqfAH55sqQRQUEaOrlbi8hM%2FfuMTRpCG7U2x4XFTqPvHPrN%2BUNg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ebc2568bd154183-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=47305&min_rtt=47305&rtt_var=23652&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    1.8kB
    144 B
    7
    3

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    689 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    1.3kB
    1.0kB
    7
    5

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    662 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 172.67.192.176:80
    http://ddrtot.shop/MV3/PWS/fre.php
    http
    aspnet_compiler.exe
    662 B
    1.1kB
    6
    6

    HTTP Request

    POST http://ddrtot.shop/MV3/PWS/fre.php

    HTTP Response

    404
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    98.208.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    98.208.201.84.in-addr.arpa

  • 8.8.8.8:53
    ddrtot.shop
    dns
    aspnet_compiler.exe
    57 B
    89 B
    1
    1

    DNS Request

    ddrtot.shop

    DNS Response

    172.67.192.176
    104.21.73.230

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    176.192.67.172.in-addr.arpa
    dns
    146 B
    135 B
    2
    1

    DNS Request

    176.192.67.172.in-addr.arpa

    DNS Request

    176.192.67.172.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    139.181.100.95.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    139.181.100.95.in-addr.arpa

  • 8.8.8.8:53
    100.209.201.84.in-addr.arpa
    dns
    73 B
    133 B
    1
    1

    DNS Request

    100.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • memory/2796-9-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2796-5-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2796-8-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2796-31-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2796-33-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2796-40-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

  • memory/2928-3-0x0000000074DC0000-0x0000000075570000-memory.dmp

    Filesize

    7.7MB

  • memory/2928-4-0x00000000023D0000-0x00000000023DA000-memory.dmp

    Filesize

    40KB

  • memory/2928-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

    Filesize

    4KB

  • memory/2928-10-0x0000000074DC0000-0x0000000075570000-memory.dmp

    Filesize

    7.7MB

  • memory/2928-2-0x0000000002570000-0x00000000025A6000-memory.dmp

    Filesize

    216KB

  • memory/2928-1-0x0000000000090000-0x00000000000CE000-memory.dmp

    Filesize

    248KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.