lokibot | 8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a

Analysis

max time kernel
124s
max time network
125s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f9a3838a5e153988e20ed0e8729739d.exe
Size 1.3MB
Sample201109-xdwca4pvps
SHA256 8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a
MD5 2f9a3838a5e153988e20ed0e8729739d
SHA1 9e66a93233d1d6cbcedfda1b5bb3168fc052dff7
SHA512 e60032c0e18a4dc8c5e655b95249df0ed3ac15e23003e2e9b087c576aa0f28ee575002b31255b797aabc39d547e4f452db2f891a41c3cbf6d114c2c97f0cab4c
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://b2bseller.ga/choolee/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 788 set thread context of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
788	2f9a3838a5e153988e20ed0e8729739d.exe
788	2f9a3838a5e153988e20ed0e8729739d.exe
788	2f9a3838a5e153988e20ed0e8729739d.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
788	2f9a3838a5e153988e20ed0e8729739d.exe
788	2f9a3838a5e153988e20ed0e8729739d.exe
788	2f9a3838a5e153988e20ed0e8729739d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26
PID 788 wrote to memory of 1920	788	2f9a3838a5e153988e20ed0e8729739d.exe	26

C:\Users\Admin\AppData\Local\Temp\2f9a3838a5e153988e20ed0e8729739d.exe
"C:\Users\Admin\AppData\Local\Temp\2f9a3838a5e153988e20ed0e8729739d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-2-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Download

memory/1920-0-0x0000000000400000-0x00000000004A2000-memory.dmp