Hidden Window
Dynamic Analysis Report
Created 2 years ago
e524d7c7a6d4ade2651a65b9d0c5e162532a70495b957b9a5d34dcaaace571fe.exe
Windows Exe (x86-32)
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 hour, 52 minutes" to "20 seconds" to reveal dormant functionality.
VMRay Threat Identifiers (32 rules, 54 matches)
| Score | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Extracted Configuration | Lokibot configuration was extracted | 1 | Spyware | |
5/5 | YARA | Malicious content matched by YARA rules | 3 | Spyware | |
5/5 | Data Collection | Tries to read cached credentials of various applications | 1 | Spyware | |
4/5 | Reputation | Known malicious file | 1 | - | |
4/5 | Reputation | Contacts known malicious URL | 1 | - | |
4/5 | Reputation | Resolves known malicious domain | 1 | - | |
3/5 | Discovery | Reads installed applications | 1 | Spyware | |
2/5 | Data Collection | Reads sensitive browser data | 4 | - | |
2/5 | Discovery | Searches for senstive application data | 1 | - | |
2/5 | Data Collection | Reads sensitive ftp data | 6 | - | |
Malware Configurations
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Credentials in Registry
Credentials in Files
Credential Dumping
Discovery
System Information Discovery
Query Registry
Browser Bookmark Discovery
File and Directory Discovery
Lateral Movement
Remote File Copy
Collection
Automated Collection
Data from Local System
Command and Control
Remote File Copy
Standard Application Layer Protocol
Exfiltration
Impact
Sample Information
| ID | #6218736 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| File Name | e524d7c7a6d4ade2651a65b9d0c5e162532a70495b957b9a5d34dcaaace571fe.exe |
| File Size | 236.42 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2022-11-25 09:11 (UTC+) |
| Analysis Duration | 00:04:00 |
| Termination Reason | Timeout |
| Number of Monitored Processes | 3 |
| Execution Successful | |
| Reputation Enabled | |
| Built-in AV Enabled | |
| Number of AV Matches | 0 |
| YARA Enabled | |
| Number of YARA Matches | 21 |
