Behavioral task
behavioral1
Sample
1744-54-0x0000000000400000-0x00000000004A2000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1744-54-0x0000000000400000-0x00000000004A2000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp
-
Size
648KB
-
MD5
ca4f42f7a4e0d2eacae3bae7c4533276
-
SHA1
50cfb264c35ee3724c54dcc0e825011e8c0b8240
-
SHA256
e31be25408dd4c49152d0a051cee534b0fd18eaa7fb8fceb9b7aaf19eee48bf0
-
SHA512
4d45c4e4bf438420b1c94dac642ea14eeb35d307f0e84dc3ba5f0b93f3231a1d8f545de6da2dbdc6986d714060cdf36bfb5da9749abd1330467c198d6f734b20
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Malware Config
Extracted
lokibot
http://abjkad.com/zoro/zoro3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp
Files
-
1744-54-0x0000000000400000-0x00000000004A2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x Size: 8KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE