MALICIOUS — 7c32810c14d99bc4e0e5b7da323072f5b5ed69a0741fcce6b343846f3d53a025

MALICIOUS — 7c32810c14d99bc4e0e5b7da323072f5b5ed69a0741fcce6b343846f3d53a025 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the LokiBot family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7c32810c14d99bc4e0e5b7da323072f5b5ed69a0741fcce6b343846f3d53a025
SHA-1: 66790e5168fef0a760dc0bb5d3bb79a5c73265a9
MD5: 59a41e4f1ea9fc91f6a0c3a4646b6ffc
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:rRWzQhILoXUwJOFGQkcZfridfNTFH4ekqvCkfUkA6AxQt+58eGWTgG+8d:0KpeGQkcZfr0fNTFH4ervCkfUkAJGW8
TLSH: T15F4EAFCD1665AB59F2F13A733094E3FEAD5B798D2CB53ED016906C22225EB378031069
Submitted as: 7c32810c14d99bc4e0e5b7da323072f5b5ed69a0741fcce6b343846f3d53a025
File type: pe · Size: 672256 bytes
Verdict: malicious (100/100) · Family: LokiBot

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.SM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!59A41E4F1EA9
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
Extracted LokiBot config (1 C2) - engine signal, weight 0.80, confidence 0.90
3 behavioral detection(s) across 3 rule(s): Credential Access: browser credential store read [high] (rule tl-browser-credential-access) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.SM!MTB (rule Trojan:MSIL/AgentTesla.SM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!59A41E4F1EA9 (rule AgentTesla-FDFG!59A41E4F1EA9) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7252 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\12BDDD\D7DD23.lck - 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
C:\Users\analyst\AppData\Roaming\12BDDD\D7DD23.exe - 044e493f385dfcb5d5d65b0d36e07f7c76aada8d2b9ff2de0309cd277be9fb6b
b06ef1eb9a563790f101dad7fc6e672a008bda931360c7133a140b040dcbc565 - b06ef1eb9a563790f101dad7fc6e672a008bda931360c7133a140b040dcbc565
ca691a704bec5ffe7eff9b755848d3e248928c232f4acf4cf1edec81a36dfae8 - ca691a704bec5ffe7eff9b755848d3e248928c232f4acf4cf1edec81a36dfae8
c4818b1222b861433248342162965d60d54098d4d4403b1c35622881b2451e02 - c4818b1222b861433248342162965d60d54098d4d4403b1c35622881b2451e02
66496a0a5395db803ee45dcb2545a4c9fbef475d9625529db71b081a1329df10 - 66496a0a5395db803ee45dcb2545a4c9fbef475d9625529db71b081a1329df10
1708d7719d5711f84b722a475ae642d1d4a4a55fee6c7ab928b8a1391eaaedf8 - 1708d7719d5711f84b722a475ae642d1d4a4a55fee6c7ab928b8a1391eaaedf8
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
3f521a3a874e45846610b68640d2a719736c476a6d69d4f0adc1cc58e964d7c6 - 3f521a3a874e45846610b68640d2a719736c476a6d69d4f0adc1cc58e964d7c6
632e4d2717d9cb07508d612452247efd06be53e7b6b46f0829ea39dbff7501e8 - 632e4d2717d9cb07508d612452247efd06be53e7b6b46f0829ea39dbff7501e8
cfe7458ab9c83785c2961a5df74488ed0cd602055ac9ff565e8c668259d112a3 - cfe7458ab9c83785c2961a5df74488ed0cd602055ac9ff565e8c668259d112a3
3adbab97fb6df5aa2408671bcf2feb6f6451f71c0750f3ee835dbc7c7346ba86 - 3adbab97fb6df5aa2408671bcf2feb6f6451f71c0750f3ee835dbc7c7346ba86
acf66e675fb2cc2314519bcebc5305ffc415fa2a4c17ad0893e3b120737016b8 - acf66e675fb2cc2314519bcebc5305ffc415fa2a4c17ad0893e3b120737016b8
c018e4e43582fc9ead01ef3e4d0f29407d33d6c111d74d605179c29c379dc5ac - c018e4e43582fc9ead01ef3e4d0f29407d33d6c111d74d605179c29c379dc5ac
0417916b726014b98601ea2e11af6de6e9371682e21e4fe621f98a6487a76eb9 - 0417916b726014b98601ea2e11af6de6e9371682e21e4fe621f98a6487a76eb9

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://63.250.40.204/~wpdemo/file.php?search=8558911
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.codeproject.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.69.116.109
52.123.252.219
4.230.171.124
48.211.4.16
20.247.185.124
74.179.77.204
74.178.76.54
4.207.44.71
74.178.76.128
172.64.154.167
92.223.78.30
52.110.12.24
52.110.12.8
172.178.240.162
63.250.40.204
4.150.223.112
104.208.16.94
52.148.114.188
52.110.12.3

More LokiBot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report