lokibot | 1df38ad7f7297914ac4345c3572a92bd2a0507baedff37681f35b3bb8fa0d9eb

Analysis

max time kernel
122s
max time network
135s
platform
windows10_x64
resource
win10v20201028
submitted
04/11/2020, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 041120-041A.exe
Size 599KB
Sample201104-d3248hjnae
SHA256 1df38ad7f7297914ac4345c3572a92bd2a0507baedff37681f35b3bb8fa0d9eb
MD5 d7d02eff717f24192284c840389d4b1d
SHA1 52b4545feafdb9e4a2f6d9f87c660c46913a75a9
SHA512 069cfbd968eb9ef5a97d174a933f26f3f5267ac55e21aca700cd398c5776a24f0d4bea542fab4b1b4146a58cf7224f667445cac89c3fb75b6740561a884ec1c1
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://79.124.8.8/plesk-site-preview/heliopoliss.com/http/79.124.8.8/kiriko/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3576 set thread context of 3520	3576	PO 041120-041A.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3520	PO 041120-041A.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	PO 041120-041A.exe
Token: SeDebugPrivilege	3520	PO 041120-041A.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78
PID 3576 wrote to memory of 3520	3576	PO 041120-041A.exe	78

C:\Users\Admin\AppData\Local\Temp\PO 041120-041A.exe
"C:\Users\Admin\AppData\Local\Temp\PO 041120-041A.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\PO 041120-041A.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 041120-041A.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3520-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3520-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3576-7-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/3576-5-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/3576-6-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/3576-0-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download

memory/3576-8-0x0000000004E70000-0x0000000004E7B000-memory.dmp

Download

memory/3576-9-0x00000000059E0000-0x0000000005A2C000-memory.dmp

Download

memory/3576-10-0x0000000005C50000-0x0000000005C6D000-memory.dmp

Download

memory/3576-4-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3576-3-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/3576-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads