Analysis
- max time kernel
125s - max time network
126s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:53
General
- Target gunzipped.exe
- Size 230KB
- Sample201109-5sfnetee3a
- SHA256 e09fbb76c70deb9d0d2b2eb99f4d179783e54fc42440c8e478ee834457982f9e
Score
10/10
Malware Config
Signatures
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-0-0x00000000026C7000-0x00000000026C8000-memory.dmp
memory/4760-1-0x0000000004150000-0x0000000004151000-memory.dmp