File name: | luim.exe |
Full analysis: | https://app.any.run/tasks/b2a85ec1-0bdb-47a3-97a9-5725ec359a12 |
Verdict: | Malicious activity |
Threats: | LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals. |
Analysis date: | November 14, 2018, 06:23:51 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
MD5: | 51A7045DEA7993BD2C4EE56716A2D945 |
SHA1: | 3C17569FCD6AF9E103E3073D4CE03C2DCF693B6F |
SHA256: | 2754356AE605C497B4DF5B5D3F74391071F48280BFA7A28B31C62E0B27A2E90C |
SSDEEP: | 12288:OK2mhAMJ/cPlG1BmR4hyArY6s6xNKztDs8kylrreJA+LmbdjY07+bn1hf3rU6OGk:f2O/GlGeR4UsrxN4s8pwmxhKbH3rUO45 |
.exe | | | Win32 Executable MS Visual C++ (generic) (35.8) |
---|---|---|
.exe | | | Win64 Executable (generic) (31.7) |
.scr | | | Windows screen saver (15) |
.dll | | | Win32 Dynamic Link Library (generic) (7.5) |
.exe | | | Win32 Executable (generic) (5.1) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2012:06:09 15:19:49+02:00 |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 74752 |
InitializedDataSize: | 58880 |
UninitializedDataSize: | - |
EntryPoint: | 0xac87 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Jun-2012 13:19:49 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 09-Jun-2012 13:19:49 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001231E | 0x00012400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55555 |
.rdata | 0x00014000 | 0x00001D15 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99401 |
.data | 0x00016000 | 0x00017724 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.54914 |
.CRT | 0x0002E000 | 0x00000020 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.394141 |
.rsrc | 0x0002F000 | 0x0000C2C0 | 0x0000C400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.36408 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.20816 | 1464 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.24143 | 556 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.26996 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.04375 | 530 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.16254 | 776 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.06352 | 380 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 2.33959 | 102 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 1.91924 | 20 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
101 | 4.19099 | 2998 | Latin 1 / Western European | English - United States | RT_BITMAP |
ASKNEXTVOL | 3.42597 | 646 | Latin 1 / Western European | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3896 | "C:\Users\admin\AppData\Local\Temp\luim.exe" | C:\Users\admin\AppData\Local\Temp\luim.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3628 | "C:\Users\admin\AppData\Local\Temp\78165621\acw.exe" swd=wws | C:\Users\admin\AppData\Local\Temp\78165621\acw.exe | — | luim.exe |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
2916 | C:\Users\admin\AppData\Local\Temp\78165621\acw.exe C:\Users\admin\AppData\Local\Temp\78165621\QDLJS | C:\Users\admin\AppData\Local\Temp\78165621\acw.exe | acw.exe | |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
2304 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | acw.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.6.1055.0 built by: NETFXREL2 |
(PID) Process: | (3896) luim.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3896) luim.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2916) acw.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | WindowsUpdate |
Value: C:\Users\admin\AppData\Local\Temp\78165621\acw.exe C:\Users\admin\AppData\Local\Temp\78165621\SWD_WW~1 | |||
(PID) Process: | (2304) RegSvcs.exe | Key: | HKEY_CURRENT_USER\������Љ��������ќ��Е�Е�����Я����Й���Й��я�� |
Operation: | write | Name: | F63AAA |
Value: %APPDATA%\F63AAA\A71D80.exe |
PID | Process | Filename | Type | |
---|---|---|---|---|
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\mnn.txt | text | |
MD5:134FDA070CD8DF509E510FB69BD000B2 | SHA256:FBD0B1144F6C9D1641E0096DF31704BD9BA26B97DFD19064C5B225E8AA79484B | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\qfu.mp4 | text | |
MD5:DEB2D09602EBDC97BFBF52C513EB2552 | SHA256:00CB64D16B954E371292300439B4E48FEBA29A9A1FC04C3537027CD0A77F4609 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\ilo.mp3 | text | |
MD5:BC4D740AEFB023EEF9500F5DA17A32F8 | SHA256:F9303E2BD0061BCBFE99F1F06E463759C1229EC73902E608E37B9037C01515F8 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\jie.pdf | text | |
MD5:3C503C16E2DA6C82474C674D5498C03F | SHA256:AA8F1A1B04DCDCEC45C982BA01D6F745C75C59071509274AFFDC8A10891C3C31 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\hrl.txt | text | |
MD5:39CD143B483866CCE34336FDC0120333 | SHA256:81E587E7C747EECB8E70132CC76357ED7EA405F461FC84401221338A27C996C4 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\bnd.jpg | text | |
MD5:CC6F0624DE917A412A6E6D2C1D2D257E | SHA256:FC90B5C00FAF22A2B13BB0C5A602F9D302D657CEEE691C71838A877CCD38B5F0 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\ist.icm | text | |
MD5:AE5F45B9BB2D5E9CBC5CF630ED6076C9 | SHA256:6D578CF274DA9C9772AB5012D9D923BBCD9054DF2926450FB271B821161EC365 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\oas.txt | text | |
MD5:108F90C1857D1DC96CF8369D8CA9583F | SHA256:DAB2DE5EA78263F28ABD53331DC49469B158DEB2EF330F423F7DDB0B885591E6 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\qch.dat | text | |
MD5:4549986577E30B223B70548CB8F11AB7 | SHA256:2C8F7F34DB59F8E12079D83ABE1E90BCE7C2F804FA79ABD220B65C6E7F8C7072 | |||
3896 | luim.exe | C:\Users\admin\AppData\Local\Temp\78165621\swd=wws | text | |
MD5:64CD2C82FCF6D4F337CB4B29CA1B073F | SHA256:3793947B27FB7F904F014290378AB29EB0915F9929B40EFD4FA065115DD70FE2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2304 | RegSvcs.exe | POST | — | 172.104.149.91:80 | http://vostokllc.com/js/jquery/Panel/five/fre.php | DE | — | — | malicious |
2304 | RegSvcs.exe | POST | — | 172.104.149.91:80 | http://vostokllc.com/js/jquery/Panel/five/fre.php | DE | — | — | malicious |
2304 | RegSvcs.exe | POST | — | 172.104.149.91:80 | http://vostokllc.com/js/jquery/Panel/five/fre.php | DE | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2304 | RegSvcs.exe | 172.104.149.91:80 | vostokllc.com | Linode, LLC | DE | malicious |
Domain | IP | Reputation |
---|---|---|
vostokllc.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
2304 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot User-Agent (Charon/Inferno) |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Checkin |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 |
2304 | RegSvcs.exe | A Network Trojan was detected | ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 |
2304 | RegSvcs.exe | A Network Trojan was detected | MALWARE [PTsecurity] Loki Bot Check-in M2 |