Overview

overview

10

Static

static

SecuriteIn...28.exe

windows7_x64

10

SecuriteIn...28.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 09:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe

  • Size

    188KB

  • MD5

    fcdf169b996d6665693fd09de8c85aa9

  • SHA1

    d6182222c7946ee1896f6b68c2cd099338afda45

  • SHA256

    43bef6cb68e3b49bbc9e40c3b1642d6e7b0c465bc04d3082662bb2e8a66bd9e0

  • SHA512

    931cc4f11d67b5204fa11c6d6e4198a7494730fe5757c14e1905345659b9f17459841169583061b16030c5008aa6d2ceb42cf1a2bf8f3630e3345098d8b4af8a

Score
10/10
guloaderlokibotcollectiondownloaderspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://178.128.244.245/search.php?key=0bd3457ea97c45faa91eb5bd8e95e7a4

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe"
    1⤵
    • Checks QEMU agent file
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe"
      2⤵
      • Checks QEMU agent file
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/808-62-0x0000000000400000-0x0000000001462000-memory.dmp
    Filesize

    16.4MB

    Download
  • memory/808-63-0x00000000001B0000-0x00000000002B0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/808-66-0x0000000076D10000-0x0000000076EB9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/808-67-0x0000000076EF0000-0x0000000077070000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/808-68-0x0000000000400000-0x0000000001462000-memory.dmp
    Filesize

    16.4MB

    Download
  • memory/960-56-0x0000000000310000-0x0000000000326000-memory.dmp
    Filesize

    88KB

    Download
  • memory/960-58-0x00000000751B1000-0x00000000751B3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/960-60-0x0000000076D10000-0x0000000076EB9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/960-61-0x0000000076EF0000-0x0000000077070000-memory.dmp
    Filesize

    1.5MB

    Download