lokibot | c4e11fc875cebd67365c8db078cd7ff8b93b9583c7f34b3e098a94ef1c2b2326

Analysis

max time kernel
125s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
Size 1.1MB
Sample201109-mkrl5667ss
SHA256 c4e11fc875cebd67365c8db078cd7ff8b93b9583c7f34b3e098a94ef1c2b2326
MD5 a3aa6ff1adac984a3a06e52e22781d61
SHA1 fa15059d07c43ab25b097e4bfb757c02b476d05d
SHA512 202c046ebbbf29c2d0f3dad3a2dad244fedd73d8f173b1456060a6124e2b6aea06ff545447d11f1af349a6ac2edc0ef1fe2711f9b08f4ab02a7e71c5facf1fbd
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://attlogistics-vn.com/first/chief2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27
PID 2036 wrote to memory of 1108	2036	NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR COVID-19 SHIPMENT_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1764-2-0x000007FEF7E60000-0x000007FEF80DA000-memory.dmp