Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
30-07-2024 02:43
General
-
Target
Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe
-
Size
995KB
-
MD5
cfe05392605f333a1ed9abc7fe992635
-
SHA1
60e56713191a5ff83cc905debd5a76c80fcd77de
-
SHA256
38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f
-
SHA512
7b0e1ba85bbea3ed3e8dc46f265c8b517bec6639e1777e2ebde4e6b336cb547a45c3e01b093d73714df253f45aab7d1635ac213a2bd1f14f70f37fa94e1de96e
-
SSDEEP
12288:rmeFmKg5mPN3ohe4/35ww17fsur4o23ZY19Uc:uJhXyaUy4og4Kc
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://serak.top/ugopounds/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2336 -s 6242⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
456KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
648KB