Analysis
-
max time kernel
129s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-01-2022 13:02
General
-
Target
eb9601823180e93e7c162ff9ed197991.exe
-
Size
299KB
-
MD5
eb9601823180e93e7c162ff9ed197991
-
SHA1
272a84e6fc6089aef0cf1f23748d47903f717e47
-
SHA256
4cdc0066a8c9c9af29fd83fc781198924e5b7fa7de206392b69440675979ae39
-
SHA512
f32d1ebd427c841218baaabc1a67493ca211591a97c5f620eaa7f432dd8572b5d84e088fac22b93b059f8c70418bc12b50455cfcee4bc8642c5075cb5db50e41
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://secure01-redirect.net/gc6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9601823180e93e7c162ff9ed197991.exe"C:\Users\Admin\AppData\Local\Temp\eb9601823180e93e7c162ff9ed197991.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
-
Filesize
8KB
-
Filesize
648KB
-
Filesize
108KB