lokibot | 09e967e35d3f03784901577e89322f008ed33c6b26453256d5b2492cab996c8d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
Size 1.1MB
Sample201109-e5vwerpmej
SHA256 09e967e35d3f03784901577e89322f008ed33c6b26453256d5b2492cab996c8d
MD5 be3900513fadd1016d09d8c8511b38eb
SHA1 12d7fc6c4d402b03833d3f6b507defec974f1995
SHA512 765b66cf9be549d0fe531801dd3f99a4a6030f447f40c64c135455af382b621ef9f29d6cb46aa44487667935a4f24e81ee0572a59d6e7587d29405478f55747b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://beesco.net/second/chief3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 1924 wrote to memory of 1884	1924	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-2-0x000007FEF6150000-0x000007FEF63CA000-memory.dmp

Download

memory/1884-0-0x0000000000400000-0x00000000004A2000-memory.dmp