Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29-11-2022 10:36
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.7894.18041.exe
-
Size
271KB
-
MD5
94eee2b3f0cdd96443ce5b40fdfbb478
-
SHA1
a3e3f0c0667b69f8df853cb8d81b4beb7cdf4b0c
-
SHA256
3b035fe66db6dd547d83303dad5af3f830ad102703324606c09e0e17076495d6
-
SHA512
eb65979eb2106ec14cc4cb1b33291166dd77046ecb9b0733758d50fbf9046381c52c96c4276fead52c85b450e2afa1fbf101f33804022ca59497270f565ffe5c
-
SSDEEP
6144:yswLlfy4t93basZbuG3qpUgo9CGjk6yllL:eJfvP3basL3soFjjQd
Malware Config
Extracted
lokibot
http://171.22.30.164/mous/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7894.18041.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7894.18041.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
84KB
-
Filesize
108KB
-
Filesize
648KB
-
Filesize
84KB
-
Filesize
648KB