Analysis Report unpacked.bin

ID:	431544
Product:	CloudBasic
Start time:	21:45:03
Start date:	08.06.2021
Sample:	unpacked.bin
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	1917f888cacd48b9a8d4832449e8d34f
SHA1:	d732e6a78ea44b77943c1e74e19c9ea92d0b7a28
SHA256:	3deeb55fefe05f51c41b1724780e5de1e33a432e01f455e3ab5d2af5ca655464
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a	data	C7ADD3D3A64EBD1148853BB23AFBA9BB	B5D425C10D7730DB432E9B0DCC74707132299F86	AF8070E934B1B40B485E661925D15D2A5B362A6924B3B7F7FFF6AF9373BAF7BA

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: unpacked.exe

Avira: detected

Found malware configuration

Source: 00000000.00000000.643480909.0000000000415000.00000002.00020000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Multi AV Scanner detection for domain / URL

Source: firenzelavori.lt	Virustotal: Detection: 10%			Perma Link
Source: https://firenzelavori.lt/loki/Panel/five/fre.php	Virustotal: Detection: 9%			Perma Link

Machine Learning detection for sample

Source: unpacked.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: unpacked.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

0_2_00403D74

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: firenzelavori.lt replaycode: Server failure (2)

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_00404ED4 recv,

0_2_00404ED4

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: firenzelavori.lt

URLs found in memory or binary data

Source: unpacked.exe	String found in binary or memory: http://www.ibsensoftware.com/
Source: unpacked.exe, 00000000.00000002.907795683.00000000004A0000.00000004.00020000.sdmp	String found in binary or memory: https://firenzelavori.lt/loki/Panel/five/fre.php

System Summary:

Malicious sample detected (through community Yara rule)

Source: unpacked.exe, type: SAMPLE	Matched rule: Loki Payload Author: kevoreilly
Source: unpacked.exe, type: SAMPLE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Detected potential crypto function

Source: C:\Users\user\Desktop\unpacked.exe	Code function: 0_2_0040549C		0_2_0040549C
Source: C:\Users\user\Desktop\unpacked.exe	Code function: 0_2_004029D4		0_2_004029D4

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\unpacked.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\unpacked.exe	Code function: String function: 00405B6F appears 41 times

Uses 32bit PE files

Source: unpacked.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Yara signature match

Source: unpacked.exe, type: SAMPLE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: unpacked.exe, type: SAMPLE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: unpacked.exe, type: SAMPLE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/2@157/0

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

0_2_0040650A

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

0_2_0040434D

Creates files inside the user directory

Source: C:\Users\user\Desktop\unpacked.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\unpacked.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

PE file has an executable .text section and no other executable section

Source: unpacked.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\unpacked.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\unpacked.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Users\user\Desktop\unpacked.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Data Obfuscation:

Yara detected aPLib compressed binary

Source: Yara match	File source: unpacked.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.907785402.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.643480909.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unpacked.exe PID: 6916, type: MEMORY
Source: Yara match	File source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE

PE file contains sections with non-standard names

Source: unpacked.exe

Static PE information: section name: .x

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\unpacked.exe	Code function: 0_2_00402AC0 push eax; ret		0_2_00402AD4
Source: C:\Users\user\Desktop\unpacked.exe	Code function: 0_2_00402AC0 push eax; ret		0_2_00402AFC

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\unpacked.exe TID: 6920

Thread sleep time: -1500000s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\unpacked.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\unpacked.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

0_2_00403D74

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\unpacked.exe

Thread delayed: delay time: 60000

Jump to behavior

Anti Debugging:

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_0040317B mov eax, dword ptr fs:[00000030h]

0_2_0040317B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_00402B7C GetProcessHeap,RtlAllocateHeap,

0_2_00402B7C

Enables debug privileges

Source: C:\Users\user\Desktop\unpacked.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: unpacked.exe, 00000000.00000002.908028408.0000000000E20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: unpacked.exe, 00000000.00000002.908028408.0000000000E20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: unpacked.exe, 00000000.00000002.908028408.0000000000E20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: unpacked.exe, 00000000.00000002.908028408.0000000000E20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\unpacked.exe

Code function: 0_2_00406069 GetUserNameW,

0_2_00406069

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\unpacked.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Source: Yara match	File source: unpacked.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.907785402.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.643480909.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unpacked.exe PID: 6916, type: MEMORY
Source: Yara match	File source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\unpacked.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\unpacked.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\unpacked.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Users\user\Desktop\unpacked.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\unpacked.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\Desktop\unpacked.exe	Code function: PopPassword		0_2_0040D069
Source: C:\Users\user\Desktop\unpacked.exe	Code function: SmtpPassword		0_2_0040D069

Yara detected Credential Stealer

Source: Yara match	File source: unpacked.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.907785402.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.643480909.0000000000415000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: unpacked.exe PID: 6916, type: MEMORY
Source: Yara match	File source: 0.2.unpacked.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.unpacked.exe.400000.0.unpack, type: UNPACKEDPE