Analysis
-
max time kernel
128s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-07-2024 07:35
General
-
Target
Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe
-
Size
995KB
-
MD5
cfe05392605f333a1ed9abc7fe992635
-
SHA1
60e56713191a5ff83cc905debd5a76c80fcd77de
-
SHA256
38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f
-
SHA512
7b0e1ba85bbea3ed3e8dc46f265c8b517bec6639e1777e2ebde4e6b336cb547a45c3e01b093d73714df253f45aab7d1635ac213a2bd1f14f70f37fa94e1de96e
-
SSDEEP
12288:rmeFmKg5mPN3ohe4/35ww17fsur4o23ZY19Uc:uJhXyaUy4og4Kc
Malware Config
Extracted
lokibot
http://serak.top/ugopounds/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2312 -s 6282⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
Filesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
456KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB