File name:

2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe

Full analysis: https://app.any.run/tasks/dfda9ee9-4ff9-4f5b-a969-58cd261caf34
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: April 29, 2025, 07:55:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
lokibot
stealer
trojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

03B196D513E102D7035A19204A36EC4C

SHA1:

74B6EB643F42253B9B60116723B95D22087A765A

SHA256:

B7EF644B7883BBBBF5F0869B193D22190260570606646E61099A7DF383144B41

SSDEEP:

6144:Fkm0qo3eFAiDpVqqOdvjYbf6BWhu/Q4RKvGEtYiqIZLTpV+xUvyVYzm58Xadg7Oq:90qNIdvjtT+9nJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • XORed URL has been found (YARA)

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Lokibot is detected

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • LOKIBOT mutex has been found

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Actions looks like stealing of personal data

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Scans artifacts that could help determine the target

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Steals credentials from Web Browsers

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Connects to the CnC server

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • LOKIBOT has been detected (SURICATA)

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
  • SUSPICIOUS

    • Application launched itself

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
    • Executable content was dropped or overwritten

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Reads security settings of Internet Explorer

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Contacting a server suspected of hosting an CnC

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
  • INFO

    • Checks supported languages

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • The sample compiled with english language support

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Create files in a temporary directory

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 4380)
    • Reads the software policy settings

      • slui.exe (PID: 5936)
      • slui.exe (PID: 6972)
    • Checks proxy server information

      • slui.exe (PID: 6972)
    • Creates files or folders in the user directory

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Reads the machine GUID from the registry

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Reads the computer name

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
    • Reads Microsoft Office registry keys

      • 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe (PID: 5364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (69.4)
.exe | Win64 Executable (generic) (23.3)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:11:06 21:43:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1015808
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x1884
OSVersion: 4
ImageVersion: 7.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.1.0.8
ProductVersionNumber: 7.1.0.8
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: SHANG
CompanyName: Hieing6
FileDescription: Calendered1
ProductName: orcin
FileVersion: 7.01.0008
ProductVersion: 7.01.0008
InternalName: launderability
OriginalFileName: launderability.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 2019-03-15-extracted-exe-from-lokibot-malspam-attachment.exe no specs sppextcomobj.exe no specs slui.exe #XOR-URL 2019-03-15-extracted-exe-from-lokibot-malspam-attachment.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2136C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4380"C:\Users\admin\AppData\Local\Temp\2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe" C:\Users\admin\AppData\Local\Temp\2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
explorer.exe
User:
admin
Company:
Hieing6
Integrity Level:
MEDIUM
Description:
Calendered1
Exit code:
0
Version:
7.01.0008
Modules
Images
c:\users\admin\appdata\local\temp\2019-03-15-extracted-exe-from-lokibot-malspam-attachment.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
5364C:\Users\admin\AppData\Local\Temp\2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe" C:\Users\admin\AppData\Local\Temp\2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
User:
admin
Company:
Hieing6
Integrity Level:
MEDIUM
Description:
Calendered1
Version:
7.01.0008
Modules
Images
c:\users\admin\appdata\local\temp\2019-03-15-extracted-exe-from-lokibot-malspam-attachment.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
5936"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6972C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
7 650
Read events
7 646
Write events
4
Delete events
0

Modification events

(PID) Process:(5364) 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5364) 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5364) 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5364) 2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeKey:HKEY_CURRENT_USER\�������О������������ќ��ѝ�Ж�����Н�������Й��я��
Operation:writeName:F3F363
Value:
%APPDATA%\F3F363\3C28B3.exe
Executable files
1
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
53642019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:
43802019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeC:\Users\admin\AppData\Local\Temp\~DFC69D0349D931380E.TMPbinary
MD5:204C5365B1779724205F5A9F9B280CDF
SHA256:D90CAD4EAAE65B2FF5EF54DCE920BE5FA2A6BBB9092A0C1A831390E63F2C4D50
53642019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.exeexecutable
MD5:03B196D513E102D7035A19204A36EC4C
SHA256:B7EF644B7883BBBBF5F0869B193D22190260570606646E61099A7DF383144B41
53642019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
53642019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdbbinary
MD5:1013079A9BF8FFA458C230EA6AAF8A89
SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
50
DNS requests
19
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
POST
404
49.13.77.253:80
http://atelierdodoce.com.br/images/bannerss/fre.php
unknown
malicious
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
POST
404
49.13.77.253:80
http://atelierdodoce.com.br/images/bannerss/fre.php
unknown
malicious
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
POST
404
49.13.77.253:80
http://atelierdodoce.com.br/images/bannerss/fre.php
unknown
malicious
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
POST
404
49.13.77.253:80
http://atelierdodoce.com.br/images/bannerss/fre.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4976
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4976
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5936
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.130
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.0
  • 20.190.159.75
  • 40.126.31.129
  • 20.190.159.4
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2a01:111:f100:a000::4134:4847
whitelisted
198.187.3.20.in-addr.arpa
unknown
7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
5364
2019-03-15-extracted-EXE-from-Lokibot-malspam-attachment.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M1
No debug info