lokibot | 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48

Analysis

max time kernel
112s
max time network
125s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LV_BALTTRA_202012LTD.exe
Size 1.1MB
Sample201109-6ll1bpmdyn
SHA256 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48
MD5 ea519dcf0455ac35ce7acef948a31c64
SHA1 539fddc8f6ed5e6ad1bda6966171c6d05cf4e3fc
SHA512 f4303b81a93a083afe25245c2cbf6104834b5a11180835353b16c754ac933ef4782f7efa39ca628e8534574a04562da1986d834f746ba058734cc20769ffe0f7
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://198.23.200.239/~boxing/.tcsogb/gi'v.php/sz3iEUXzHMQ3c
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1968	1588	LV_BALTTRA_202012LTD.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1588	LV_BALTTRA_202012LTD.exe
1588	LV_BALTTRA_202012LTD.exe
1588	LV_BALTTRA_202012LTD.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1588	LV_BALTTRA_202012LTD.exe
1588	LV_BALTTRA_202012LTD.exe
1588	LV_BALTTRA_202012LTD.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26
PID 1588 wrote to memory of 1968	1588	LV_BALTTRA_202012LTD.exe	26

C:\Users\Admin\AppData\Local\Temp\LV_BALTTRA_202012LTD.exe
"C:\Users\Admin\AppData\Local\Temp\LV_BALTTRA_202012LTD.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-2-0x000007FEF68D0000-0x000007FEF6B4A000-memory.dmp

Download

memory/1968-0-0x0000000000400000-0x00000000004A2000-memory.dmp