lokibot | c224d671ef8ea5bfdc03b9a33d7ae043827b83c2ddc96e7ce128efb36f26fb9e

Analysis

max time kernel
128s
max time network
130s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EIKODO_PURCHASE-ORDER-MAY.exe
Size 1.4MB
Sample201109-ye4hhbwrma
SHA256 c224d671ef8ea5bfdc03b9a33d7ae043827b83c2ddc96e7ce128efb36f26fb9e
MD5 0277b9d4e3a1da6a501acfde1777ba82
SHA1 bad9604e63ed6bbcc4697b163b01cdecb9db6255
SHA512 8b2918c4093c877379f9d49ae86b8c0e504975cb4db889114777a0ff67d3a2234c39e879b1a7a8373781c560fb5036abb8665131949d401a3f6b022ac1ebbbfb
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://oneflextiank.com/click/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 1008	4092	EIKODO_PURCHASE-ORDER-MAY.exe	78

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4092	EIKODO_PURCHASE-ORDER-MAY.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4092	EIKODO_PURCHASE-ORDER-MAY.exe
4092	EIKODO_PURCHASE-ORDER-MAY.exe
4092	EIKODO_PURCHASE-ORDER-MAY.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4092	EIKODO_PURCHASE-ORDER-MAY.exe
4092	EIKODO_PURCHASE-ORDER-MAY.exe
4092	EIKODO_PURCHASE-ORDER-MAY.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 1008	4092	EIKODO_PURCHASE-ORDER-MAY.exe	78
PID 4092 wrote to memory of 1008	4092	EIKODO_PURCHASE-ORDER-MAY.exe	78
PID 4092 wrote to memory of 1008	4092	EIKODO_PURCHASE-ORDER-MAY.exe	78
PID 4092 wrote to memory of 1008	4092	EIKODO_PURCHASE-ORDER-MAY.exe	78

C:\Users\Admin\AppData\Local\Temp\EIKODO_PURCHASE-ORDER-MAY.exe
"C:\Users\Admin\AppData\Local\Temp\EIKODO_PURCHASE-ORDER-MAY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1008-2-0x0000000000400000-0x00000000004A2000-memory.dmp