Overview

overview

10

Static

static

SecuriteIn...57.exe

windows7_x64

10

SecuriteIn...57.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    70s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-07-2022 07:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.AIDetectNet.01.257.exe

  • Size

    533KB

  • MD5

    5f7378a03aa70ca7f2da90fa87fd85e9

  • SHA1

    25eb0c72c4eaecc342317c35880adbbb3f5eba01

  • SHA256

    89f7f601216e8c0364524db378f16a0298616bd614c17088e9cc4070357e6931

  • SHA512

    7536eaeeb8b0a6aa0b0040d3e05d8c3be3fa6b779922e8f50994ea69c211563e923e108caf1cd305614d03b80bffbd41e0ebcc229c3caf35a8c23e777ce8dba2

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=614956569061910

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    suricata
  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    suricata
  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata
  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    suricata
  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    suricata
  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ugJaDZJWfXk.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4468
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugJaDZJWfXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2500
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.257.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    a2929c950a1a24cb81970b1820953b8d

    SHA1

    8402608e76d60e3140c2fefb64dee732051c8d43

    SHA256

    30d32c6841509bc5163999a6042283f7f6199288c42679d64451cf200ca9b036

    SHA512

    e7d938dc232d990ba646ff8c02da3e2fcfcc4cb32736cc16fb43ad52dc017f6633a0f4907e6acd3dfc8f85013a76f1952357144fdd999e6aa1856ee62e2a02d1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp
    Filesize

    1KB

    MD5

    4d6cc4456bb5a9a3ada14d9a9d5312c2

    SHA1

    72cbf9110777432ebb76ba14261d7d7062c3be55

    SHA256

    ec0a85ca0ee1bc2dd3e696f9f6d457c3a41a459b19d05aa7a1ecb4a7619a7915

    SHA512

    d36b28d1a46ba42926e64cb87869c489c0e3a822253e35cbc65046ffdf69a030695a06b3a8401f213904a3b424e83df4ea6ce71f9ff6b8d05cd383fb63f73f97

    Download Submit
  • memory/1860-131-0x0000000005890000-0x0000000005E34000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/1860-132-0x0000000005380000-0x0000000005412000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1860-133-0x0000000005330000-0x000000000533A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1860-134-0x00000000091E0000-0x000000000927C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/1860-135-0x0000000009310000-0x0000000009376000-memory.dmp
    Filesize

    408KB

    Download
  • memory/1860-130-0x00000000008F0000-0x000000000097A000-memory.dmp
    Filesize

    552KB

    Download
  • memory/2500-138-0x0000000000000000-mapping.dmp
    Download
  • memory/3048-147-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/3048-148-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/3048-142-0x0000000000000000-mapping.dmp
    Download
  • memory/3048-144-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/3048-163-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/3248-143-0x0000000005490000-0x00000000054B2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/3248-139-0x0000000004E80000-0x0000000004EB6000-memory.dmp
    Filesize

    216KB

    Download
  • memory/3248-160-0x0000000007A70000-0x0000000007A78000-memory.dmp
    Filesize

    32KB

    Download
  • memory/3248-149-0x0000000006450000-0x000000000646E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3248-150-0x0000000007430000-0x0000000007462000-memory.dmp
    Filesize

    200KB

    Download
  • memory/3248-152-0x00000000731B0000-0x00000000731FC000-memory.dmp
    Filesize

    304KB

    Download
  • memory/3248-140-0x0000000005550000-0x0000000005B78000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/3248-153-0x0000000006A00000-0x0000000006A1E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3248-154-0x0000000007DA0000-0x000000000841A000-memory.dmp
    Filesize

    6.5MB

    Download
  • memory/3248-155-0x0000000007750000-0x000000000776A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/3248-136-0x0000000000000000-mapping.dmp
    Download
  • memory/4468-151-0x00000000731B0000-0x00000000731FC000-memory.dmp
    Filesize

    304KB

    Download
  • memory/4468-158-0x0000000007AB0000-0x0000000007ABE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4468-159-0x0000000007BC0000-0x0000000007BDA000-memory.dmp
    Filesize

    104KB

    Download
  • memory/4468-157-0x0000000007B00000-0x0000000007B96000-memory.dmp
    Filesize

    600KB

    Download
  • memory/4468-137-0x0000000000000000-mapping.dmp
    Download
  • memory/4468-156-0x00000000078F0000-0x00000000078FA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4468-145-0x0000000005E90000-0x0000000005EF6000-memory.dmp
    Filesize

    408KB

    Download