Overview

overview

10

Static

static

3

32b3f3b171...dd.exe

windows7-x64

10

32b3f3b171...dd.exe

windows10-2004-x64

10

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ge.dll

windows7-x64

1

$PLUGINSDI...ge.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    32b3f3b17100cf0c711e1e2267fc9ec4f71b0214b3013fe4d5fe2617dea779dd.exe
  • Size 488KB
  • Sample240705-bkmtss1dma
  • SHA256 32b3f3b17100cf0c711e1e2267fc9ec4f71b0214b3013fe4d5fe2617dea779dd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

Malware Config

Targets

    • Target
      32b3f3b17100cf0c711e1e2267fc9ec4f71b0214b3013fe4d5fe2617dea779dd.exe
    • Size 488KB
    • SHA256 32b3f3b17100cf0c711e1e2267fc9ec4f71b0214b3013fe4d5fe2617dea779dd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderlokibotcollectiondownloaderexecutionspywarestealertrojan

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/Banner.dll
    • Size 4KB
    • SHA256 b935d14c32ad8e16055f7f5794ac3411e601c5ac93155afc623f25b08e2ab82e
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/BgImage.dll
    • Size 7KB
    • SHA256 6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 72b38e4cca0af336655d55501c4ea05080baaa9921a62a2d717afe90bb801004
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks