General
-
Target
TT NOTE66126663.xlsx
-
Size
177KB
-
Sample
220707-h1qzqaeher
-
MD5
68041bd7198cc44fc2e3d443d65685e6
-
SHA1
7c27c2ff8b2594be9530ceb7f5e7d1d600426a79
-
SHA256
730a0a1528faa54fd39066991b6ff26b2bb870b48e01d3a35e2ce8bdf2dca2c5
-
SHA512
cd208c719f5088da2db1d1683a4d20af06cd0ae5cefc51b46c1b7bc60e45f14c175e6bb292f0b153ca6c8f543b216a96d42178e6fb78614e15fef22ac21e6d0b
Static task
static1
Behavioral task
behavioral1
Sample
TT NOTE66126663.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TT NOTE66126663.xlsx
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://hyatqfuh9olahvxf.ga/BN1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
TT NOTE66126663.xlsx
-
Size
177KB
-
MD5
68041bd7198cc44fc2e3d443d65685e6
-
SHA1
7c27c2ff8b2594be9530ceb7f5e7d1d600426a79
-
SHA256
730a0a1528faa54fd39066991b6ff26b2bb870b48e01d3a35e2ce8bdf2dca2c5
-
SHA512
cd208c719f5088da2db1d1683a4d20af06cd0ae5cefc51b46c1b7bc60e45f14c175e6bb292f0b153ca6c8f543b216a96d42178e6fb78614e15fef22ac21e6d0b
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-