Extracted

• • Target

    PurchaseXOrderXNo.4036041334.docx.doc

  • Size

    16KB

  • MD5

    e1d91cae0bc5e4510f6a07c38ed9db1f

  • SHA1

    0d1288b1c6ca2e30910712c5e0d881a8b54caaa2

  • SHA256

    15479d24a288ccce5ac421de34259518026761dde5f452bc1756fb557b09cfee

  • SHA512

    37a8b983183ba1acba1254b3c323d8a1becace5a0d305ed977fa2f85df93184b5a24c57b861a8952a808b1932ce75353133b5a30fff218d382caf23227215d8b

  • SSDEEP

    384:tyXLyi0WVs8PL8wi4OEwH8TIbE91r2fRXJYsvi1x3egCy:tcLm65P3DOqnYJ5Zvcx3eg7

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Abuses OpenXML format to download file from external location

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2