Overview

overview

10

Static

static

10

c046027428...0c.exe

windows7-x64

10

c046027428...0c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2024, 07:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe

  • Size

    96KB

  • MD5

    d7ede461fd6438cfae2cba59fa1e07e9

  • SHA1

    b6f2dbb0d2ae969583a96b8463ccc561324c7b27

  • SHA256

    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c

  • SHA512

    3dd06de3fbd5f2e76ec458b4cb3045f265888b8fcfb99451ad6ec960dc1e592b79393f580dbc2ca4e0cda3d867925949b63815cb9553e143a45d5d28c024a431

  • SSDEEP

    1536:6zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqnIzmd:hSHIG6mQwGmfOQd8YhY0/EKUG

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.41/simple/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Lokibot family
    lokibot
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    "C:\Users\Admin\AppData\Local\Temp\c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:2316

Network

  • flag-de
    POST
    http://94.156.177.41/simple/five/fre.php
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    Remote address:
    94.156.177.41:80
    Request
    POST /simple/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.41
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: A6A8C306
    Content-Length: 374
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Mon, 09 Dec 2024 07:32:59 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    X-Powered-By: PHP/5.4.16
  • flag-de
    POST
    http://94.156.177.41/simple/five/fre.php
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    Remote address:
    94.156.177.41:80
    Request
    POST /simple/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.41
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: A6A8C306
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Mon, 09 Dec 2024 07:33:00 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    X-Powered-By: PHP/5.4.16
  • flag-de
    POST
    http://94.156.177.41/simple/five/fre.php
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    Remote address:
    94.156.177.41:80
    Request
    POST /simple/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.41
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: A6A8C306
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Mon, 09 Dec 2024 07:33:01 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    X-Powered-By: PHP/5.4.16
  • flag-de
    POST
    http://94.156.177.41/simple/five/fre.php
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    Remote address:
    94.156.177.41:80
    Request
    POST /simple/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.41
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: A6A8C306
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Mon, 09 Dec 2024 07:34:04 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    X-Powered-By: PHP/5.4.16
  • flag-de
    POST
    http://94.156.177.41/simple/five/fre.php
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    Remote address:
    94.156.177.41:80
    Request
    POST /simple/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: 94.156.177.41
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: A6A8C306
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.26.1
    Date: Mon, 09 Dec 2024 07:35:05 GMT
    Content-Type: text/html; charset=utf-8
    Connection: close
    X-Powered-By: PHP/5.4.16
  • 94.156.177.41:80
    http://94.156.177.41/simple/five/fre.php
    http
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    889 B
     437 B
     6
    6

    HTTP Request

    POST http://94.156.177.41/simple/five/fre.php

    HTTP Response

    404
  • 94.156.177.41:80
    http://94.156.177.41/simple/five/fre.php
    http
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    741 B
     437 B
     7
    6

    HTTP Request

    POST http://94.156.177.41/simple/five/fre.php

    HTTP Response

    404
  • 94.156.177.41:80
    http://94.156.177.41/simple/five/fre.php
    http
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    668 B
     445 B
     6
    6

    HTTP Request

    POST http://94.156.177.41/simple/five/fre.php

    HTTP Response

    404
  • 94.156.177.41:80
    http://94.156.177.41/simple/five/fre.php
    http
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    720 B
     445 B
     7
    6

    HTTP Request

    POST http://94.156.177.41/simple/five/fre.php

    HTTP Response

    404
  • 94.156.177.41:80
    http://94.156.177.41/simple/five/fre.php
    http
    c046027428e0fb93ae035e318138a2f8d6b5830bc81d825e2f0e8d72e827660c.exe
    668 B
     445 B
     6
    6

    HTTP Request

    POST http://94.156.177.41/simple/five/fre.php

    HTTP Response

    404
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • memory/2316-18-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/2316-31-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.