lokibot | 5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c | Triage™

Analysis

max time kernel
38s
max time network
115s
platform
windows10_x64
resource
win10v20201028
submitted
15/11/2020, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe
Size 532KB
Sample201115-tm3ss333e2
SHA256 5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c
MD5 c9710e6baabfed7c0805ac91e8411246
SHA1 19ce30d218a8d95cd1858b3c66821e6b82340522
SHA512 7c768c9ec0d24d81a7c70680aed1cc896f2e919dcb479699a3df1c731ad90e4fb4b2de868003ef1a7f290847465f3787a2d1272b4f8083b89b91f6baee6c201e
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4040	5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe
4040	5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4040	5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe

C:\Users\Admin\AppData\Local\Temp\5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe
"C:\Users\Admin\AppData\Local\Temp\5703a2c4b9de691d7acbb7faa076945e75a0cb39fcf904576ece19e596a2d48c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads