Overview

overview

10

Static

static

3

Request fo...mg.exe

windows7-x64

10

Request fo...mg.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-07-2024 07:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe

  • Size

    995KB

  • MD5

    cfe05392605f333a1ed9abc7fe992635

  • SHA1

    60e56713191a5ff83cc905debd5a76c80fcd77de

  • SHA256

    38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f

  • SHA512

    7b0e1ba85bbea3ed3e8dc46f265c8b517bec6639e1777e2ebde4e6b336cb547a45c3e01b093d73714df253f45aab7d1635ac213a2bd1f14f70f37fa94e1de96e

  • SSDEEP

    12288:rmeFmKg5mPN3ohe4/35ww17fsur4o23ZY19Uc:uJhXyaUy4og4Kc

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://serak.top/ugopounds/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe
    "C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      2⤵
        PID:4176
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
        2⤵
        • Suspicious use of UnmapMainImage
        PID:2012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 16
          3⤵
          • Program crash
          PID:4488
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
        2⤵
          PID:3060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2012 -ip 2012
        1⤵
          PID:4988

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2012-4-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

          Download

        • memory/3696-1-0x0000019C717B0000-0x0000019C717BA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/3696-0-0x00007FFC7DCD3000-0x00007FFC7DCD5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3696-2-0x0000019C71B50000-0x0000019C71BC2000-memory.dmp

          Filesize

          456KB

          Download

        • memory/3696-3-0x00007FFC7DCD0000-0x00007FFC7E791000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3696-5-0x00007FFC7DCD0000-0x00007FFC7E791000-memory.dmp

          Filesize

          10.8MB

          Download