Overview

overview

10

Static

static

7

PO 67854.exe

windows7-x64

10

PO 67854.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 06:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO 67854.exe

  • Size

    557KB

  • MD5

    bb12506f8b9ea1550c8c09fdb754f747

  • SHA1

    4a90dcdfcef57f4052d38257cac5e392ffa329ff

  • SHA256

    ee98f6ee8e92f87f03ff4d3c5764a3b8d384aa0130ce1e7a4d77bd091e8beea3

  • SHA512

    260726f643a6c3d5a8d1a46abce9b7ef68352bf465b6049e01bd1e4811b5638ca11e0020314be96ce60ed5228d87cab6caed677e009f2db36b4762705d33ddc5

  • SSDEEP

    12288:MsHzOUNUSB/o5LsI1uwajJ5yvv1l2Yojq6bCiBbzl4:PiUmSB/o5d1ubcvtojJCiO

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

lokibot

C2

http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO 67854.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 67854.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\PO 67854.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2684

Network

  • flag-us
    POST
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    svchost.exe
    Remote address:
    45.61.136.20:80
    Request
    POST /index.php/jlbcyg0q595vs4hef0 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 45.61.136.20
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 63C4AFE6
    Content-Length: 374
    Connection: close
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 26 Jul 2024 06:56:08 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Content-Length: 2557
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    POST
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    svchost.exe
    Remote address:
    45.61.136.20:80
    Request
    POST /index.php/jlbcyg0q595vs4hef0 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 45.61.136.20
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 63C4AFE6
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 26 Jul 2024 06:56:10 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Content-Length: 2557
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    POST
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    svchost.exe
    Remote address:
    45.61.136.20:80
    Request
    POST /index.php/jlbcyg0q595vs4hef0 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 45.61.136.20
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 63C4AFE6
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 26 Jul 2024 06:56:13 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Content-Length: 2557
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    POST
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    svchost.exe
    Remote address:
    45.61.136.20:80
    Request
    POST /index.php/jlbcyg0q595vs4hef0 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 45.61.136.20
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 63C4AFE6
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 26 Jul 2024 06:57:16 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Content-Length: 2557
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    POST
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    svchost.exe
    Remote address:
    45.61.136.20:80
    Request
    POST /index.php/jlbcyg0q595vs4hef0 HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 45.61.136.20
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: 63C4AFE6
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.0 500 Internal Server Error
    Date: Fri, 26 Jul 2024 06:58:19 GMT
    Server: Apache/2.4.58 (Ubuntu)
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Content-Length: 2557
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 45.61.136.20:80
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    http
    svchost.exe
    1.0kB
     3.2kB
     9
    8

    HTTP Request

    POST http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

    HTTP Response

    500
  • 45.61.136.20:80
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    http
    svchost.exe
    699 B
     3.1kB
     6
    7

    HTTP Request

    POST http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

    HTTP Response

    500
  • 45.61.136.20:80
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    http
    svchost.exe
    814 B
     3.2kB
     9
    8

    HTTP Request

    POST http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

    HTTP Response

    500
  • 45.61.136.20:80
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    http
    svchost.exe
    810 B
     3.2kB
     9
    8

    HTTP Request

    POST http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

    HTTP Response

    500
  • 45.61.136.20:80
    http://45.61.136.20/index.php/jlbcyg0q595vs4hef0
    http
    svchost.exe
    814 B
     3.2kB
     9
    8

    HTTP Request

    POST http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

    HTTP Response

    500
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3294248377-1418901787-4083263181-1000\0f5007522459c86e95ffcc62f32308f1_ecb53134-212c-4ea0-b42c-6ba9df06ace3
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3294248377-1418901787-4083263181-1000\0f5007522459c86e95ffcc62f32308f1_ecb53134-212c-4ea0-b42c-6ba9df06ace3
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • memory/2684-13-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2684-15-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2684-18-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2684-39-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2684-48-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2784-0-0x00000000011C0000-0x0000000001303000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2784-12-0x0000000000100000-0x0000000000104000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2784-17-0x00000000011C0000-0x0000000001303000-memory.dmp

    Filesize

    1.3MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.