Edit tour

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Sample Name:	INV.2022LB0362 FORM CO (2).exe
Analysis ID:	756310
MD5:	baed30aea51e6000571219633aa745b0
SHA1:	d7e3b155c00245a7f867dd2fb4c06cb7be6ec3f7
SHA256:	57520e51bb0820741b7883926800223886c491a8a5ddd517a49b0e2cc752fb18
Tags:	exeLoki
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Lokibot

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

INV.2022LB0362 FORM CO (2).exe (PID: 6092 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 2240 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 5164 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 6132 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://sempersim.su/gm11/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x180c8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x5493:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13cd7:$des3: 68 03 66 00 00 0x180c8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18194:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x37f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x32e90:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x2024f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2ea93:$des3: 68 03 66 00 00 0x32e90:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x32f5c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x43bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x510a8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3e473:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x4ccb7:$des3: 68 03 66 00 00 0x510a8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x51174:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x2dd9c:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x570a6:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x155d18:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x299d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x2ef38:$s1: http:// 0x326f3:$s1: http:// 0x3314c:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x2ef40:$s2: https:// 0x2ef38:$f1: http:// 0x326f3:$f1: http:// 0x2ef40:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x315f6:$f1: FileZilla\recentservers.xml 0x31636:$f2: FileZilla\sitemanager.xml 0x2f8a6:$b2: Mozilla\Firefox\Profiles 0x2f610:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f7ba:$s4: logins.json 0x30664:$s6: wand.dat 0x2f0e4:$a1: username_value 0x2f0d4:$a2: password_value 0x2f71f:$a3: encryptedUsername 0x2f78c:$a3: encryptedUsername 0x2f732:$a4: encryptedPassword 0x2f7a0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x324b0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x1f86f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x2ee74:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x2f0bc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2e0b3:$des3: 68 03 66 00 00 0x324b0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x3257c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 43 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024318 11/30/22-00:54:20.168790
SID:	2024318
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802021641 11/30/22-00:54:14.871390
SID:	2021641
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024313 11/30/22-00:55:23.450513
SID:	2024313
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802825766 11/30/22-00:55:16.065951
SID:	2825766
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497272025483 11/30/22-00:55:04.982566
SID:	2025483
Source Port:	80
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024313 11/30/22-00:55:29.247109
SID:	2024313
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802825766 11/30/22-00:54:12.581436
SID:	2825766
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802025381 11/30/22-00:55:43.976237
SID:	2025381
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802825766 11/30/22-00:56:01.042444
SID:	2825766
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024318 11/30/22-00:55:23.450513
SID:	2024318
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802021641 11/30/22-00:55:17.863854
SID:	2021641
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024313 11/30/22-00:54:20.168790
SID:	2024313
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024318 11/30/22-00:55:29.247109
SID:	2024318
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497232025483 11/30/22-00:54:57.894669
SID:	2025483
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802025381 11/30/22-00:55:49.378987
SID:	2025381
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802025381 11/30/22-00:54:43.829219
SID:	2025381
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802021641 11/30/22-00:54:24.716724
SID:	2021641
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802025381 11/30/22-00:55:58.948901
SID:	2025381
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802021641 11/30/22-00:55:08.823725
SID:	2021641
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861416532014169 11/30/22-00:55:12.379224
SID:	2014169
Source Port:	61416
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860088532014169 11/30/22-00:55:21.529314
SID:	2014169
Source Port:	60088
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024313 11/30/22-00:54:37.979213
SID:	2024313
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802825766 11/30/22-00:55:01.673863
SID:	2825766
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024318 11/30/22-00:54:37.979213
SID:	2024318
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857743532014169 11/30/22-00:55:08.735474
SID:	2014169
Source Port:	57743
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802825766 11/30/22-00:55:53.496270
SID:	2825766
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497572025483 11/30/22-00:55:59.773200
SID:	2025483
Source Port:	80
Destination Port:	49757
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802025381 11/30/22-00:55:34.401351
SID:	2025381
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859820532014169 11/30/22-00:55:29.162121
SID:	2014169
Source Port:	59820
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853305532014169 11/30/22-00:54:54.648302
SID:	2014169
Source Port:	53305
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497532025483 11/30/22-00:55:52.887247
SID:	2025483
Source Port:	80
Destination Port:	49753
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802025381 11/30/22-00:54:26.803652
SID:	2025381
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497162025483 11/30/22-00:54:45.204539
SID:	2025483
Source Port:	80
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response -

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe