File name:

2018-11-26-Lokibot-extracted-from-attached-archive.exe

Full analysis: https://app.any.run/tasks/6b15b407-79b2-4e36-ae86-0619dc805443
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Analysis date: April 29, 2025, 07:38:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
guloader
stealer
lokibot
trojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

6D9AC94EBAF3BCC0F586B80FDA57F010

SHA1:

62B9D9C3903EE8D814B3424C08886481F017CD31

SHA256:

74F24D80CA15FD2123604C562E60908DE928CD2742BA2783AEBA4DAE91FAEFB6

SSDEEP:

6144:6YWYuq5SdGwTirUT7jOkZFsQtdtMjY+AX/ktgSORj9tyO3gukCodp/nnhq70wtKL:uJjd5zT7akZRtXcwyPnku8Ry7x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • GULOADER has been detected (YARA)

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • GULOADER SHELLCODE has been detected (YARA)

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Lokibot is detected

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • LOKIBOT mutex has been found

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Scans artifacts that could help determine the target

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Actions looks like stealing of personal data

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Connects to the CnC server

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • LOKIBOT has been detected (SURICATA)

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
  • SUSPICIOUS

    • Application launched itself

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
    • Executable content was dropped or overwritten

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Reads security settings of Internet Explorer

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Contacting a server suspected of hosting an CnC

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
  • INFO

    • Reads the computer name

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • The sample compiled with english language support

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Checks supported languages

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Create files in a temporary directory

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4208)
    • Reads the software policy settings

      • slui.exe (PID: 5800)
      • slui.exe (PID: 1272)
    • Checks proxy server information

      • slui.exe (PID: 1272)
    • Reads Microsoft Office registry keys

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Reads the machine GUID from the registry

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
    • Creates files or folders in the user directory

      • 2018-11-26-Lokibot-extracted-from-attached-archive.exe (PID: 4736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2002:12:16 12:40:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1077248
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x15f0
OSVersion: 4
ImageVersion: 1.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.0.8
ProductVersionNumber: 1.5.0.8
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Syncretist9
CompanyName: GYMNOSPERMIC10
FileDescription: Inapperceptible
LegalCopyright: eliquation10
LegalTrademarks: Auxometer
ProductName: serogelatinous8
FileVersion: 1.05.0008
ProductVersion: 1.05.0008
InternalName: LOOPFUL
OriginalFileName: LOOPFUL.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2018-11-26-lokibot-extracted-from-attached-archive.exe no specs sppextcomobj.exe no specs slui.exe #GULOADER 2018-11-26-lokibot-extracted-from-attached-archive.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1272C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2140C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4208"C:\Users\admin\AppData\Local\Temp\2018-11-26-Lokibot-extracted-from-attached-archive.exe" C:\Users\admin\AppData\Local\Temp\2018-11-26-Lokibot-extracted-from-attached-archive.exeexplorer.exe
User:
admin
Company:
GYMNOSPERMIC10
Integrity Level:
MEDIUM
Description:
Inapperceptible
Exit code:
0
Version:
1.05.0008
Modules
Images
c:\users\admin\appdata\local\temp\2018-11-26-lokibot-extracted-from-attached-archive.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
4736C:\Users\admin\AppData\Local\Temp\2018-11-26-Lokibot-extracted-from-attached-archive.exe" C:\Users\admin\AppData\Local\Temp\2018-11-26-Lokibot-extracted-from-attached-archive.exe
2018-11-26-Lokibot-extracted-from-attached-archive.exe
User:
admin
Company:
GYMNOSPERMIC10
Integrity Level:
MEDIUM
Description:
Inapperceptible
Version:
1.05.0008
Modules
Images
c:\users\admin\appdata\local\temp\2018-11-26-lokibot-extracted-from-attached-archive.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
5800"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
7 677
Read events
7 673
Write events
4
Delete events
0

Modification events

(PID) Process:(4736) 2018-11-26-Lokibot-extracted-from-attached-archive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4736) 2018-11-26-Lokibot-extracted-from-attached-archive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4736) 2018-11-26-Lokibot-extracted-from-attached-archive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4736) 2018-11-26-Lokibot-extracted-from-attached-archive.exeKey:HKEY_CURRENT_USER\������Ј��х�����������ќ��Н������Ѝ�����Й��я��
Operation:writeName:F3F363
Value:
%APPDATA%\F3F363\3C28B3.exe
Executable files
1
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
47362018-11-26-Lokibot-extracted-from-attached-archive.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:
47362018-11-26-Lokibot-extracted-from-attached-archive.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
42082018-11-26-Lokibot-extracted-from-attached-archive.exeC:\Users\admin\AppData\Local\Temp\~DF02CEA6E71F762668.TMPbinary
MD5:3076580999AB7203A02990875A8706DC
SHA256:968BC3C45350E0453AB76D53EB4DE6BE482338990D03EE3F57F5242D1554AD98
47362018-11-26-Lokibot-extracted-from-attached-archive.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdbbinary
MD5:1013079A9BF8FFA458C230EA6AAF8A89
SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8
47362018-11-26-Lokibot-extracted-from-attached-archive.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.exeexecutable
MD5:6D9AC94EBAF3BCC0F586B80FDA57F010
SHA256:74F24D80CA15FD2123604C562E60908DE928CD2742BA2783AEBA4DAE91FAEFB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
51
DNS requests
17
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
POST
404
49.13.77.253:80
http://www.zereocompany.com/bazzltd/roks04/fre.php
unknown
malicious
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
POST
404
49.13.77.253:80
http://www.zereocompany.com/bazzltd/roks04/fre.php
unknown
malicious
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
POST
404
49.13.77.253:80
http://www.zereocompany.com/bazzltd/roks04/fre.php
unknown
malicious
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
POST
404
49.13.77.253:80
http://www.zereocompany.com/bazzltd/roks04/fre.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4024
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4024
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.31.129
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.128
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:408:7::3d
whitelisted
198.187.3.20.in-addr.arpa
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
4736
2018-11-26-Lokibot-extracted-from-attached-archive.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M1
No debug info