Overview

overview

10

Static

static

SecuriteIn...57.exe

windows7_x64

10

SecuriteIn...57.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    81s
  • max time network
    84s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    05-07-2022 07:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.AIDetectNet.01.257.exe

  • Size

    533KB

  • MD5

    5f7378a03aa70ca7f2da90fa87fd85e9

  • SHA1

    25eb0c72c4eaecc342317c35880adbbb3f5eba01

  • SHA256

    89f7f601216e8c0364524db378f16a0298616bd614c17088e9cc4070357e6931

  • SHA512

    7536eaeeb8b0a6aa0b0040d3e05d8c3be3fa6b779922e8f50994ea69c211563e923e108caf1cd305614d03b80bffbd41e0ebcc229c3caf35a8c23e777ce8dba2

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=614956569061910

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata
  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata
  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata
  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata
  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata
  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ugJaDZJWfXk.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1948
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugJaDZJWfXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1712
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp
    Filesize

    1KB

    MD5

    48e3d10ff22ea308239b636fed6c463d

    SHA1

    f7075eed4f763113204bb7a8ecbcb9d91414c4be

    SHA256

    9ed94a4caaf5bc5a5653dfaebf5445f50d0c135911a2340602000091108ea316

    SHA512

    12b1f9c1560695638645a27d36c5e5178f3df4568eb419ea010f0f47e12e605151c6dd300dda1b28ad03780873f94fadc6510259ba4846f7b0d3d336bc944b8d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    113d5ac1a886e957ec70d0c22000872a

    SHA1

    7c555bd48fcc98d06745a774b9b4adb23de0d3e0

    SHA256

    5580eb21e878e5d96328564c9502630205f5bf668c5ea0438ec76952bd0346b1

    SHA512

    b7e9324adc9c4b2454dfff3b57cff104c5cda004f0c77c9999983d3d86f6f06947a6c5a6834de5d1a9486a4cf3a82c97b7282390d54a4f5c5dc3a2cc389c05ec

    Download Submit
  • memory/784-55-0x0000000076391000-0x0000000076393000-memory.dmp
    Filesize

    8KB

    Download
  • memory/784-56-0x0000000000540000-0x0000000000560000-memory.dmp
    Filesize

    128KB

    Download
  • memory/784-57-0x00000000009B0000-0x00000000009BE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/784-58-0x0000000005C10000-0x0000000005C74000-memory.dmp
    Filesize

    400KB

    Download
  • memory/784-54-0x0000000000040000-0x00000000000CA000-memory.dmp
    Filesize

    552KB

    Download
  • memory/784-66-0x0000000004F70000-0x0000000004F90000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1140-78-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-76-0x00000000004139DE-mapping.dmp
    Download
  • memory/1140-85-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-67-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-68-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-70-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-72-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-73-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-75-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1140-80-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1712-62-0x0000000000000000-mapping.dmp
    Download
  • memory/1948-81-0x000000006F390000-0x000000006F93B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1948-83-0x000000006F390000-0x000000006F93B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1948-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1996-59-0x0000000000000000-mapping.dmp
    Download
  • memory/1996-82-0x000000006F390000-0x000000006F93B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1996-84-0x000000006F390000-0x000000006F93B000-memory.dmp
    Filesize

    5.7MB

    Download