lokibot | 3eb7b4baf0f3d7c432ad06fb577907e64e8387894289bbfc04bfd2e8f9891f16

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
30/11/2020, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe
Size 296KB
Sample201130-ghp5b3abda
SHA256 3eb7b4baf0f3d7c432ad06fb577907e64e8387894289bbfc04bfd2e8f9891f16
MD5 e4aed5c4082b94eb7cedec454e756a60
SHA1 17ae501620ddfd7659bf05b036f6402b60898bfb
SHA512 db20adf3b87876dfe14cf52e7b248cf14904caf3d2ee1ccf2415f98f39b979e9a092b5314b705e0aed7cf60760be9db69851306136ec52bcd1b8b3f248df9d0d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://104.168.146.103/MegAMOneyMenINTurkey/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 3156	984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe	71

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3156	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3156	984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe	71
PID 984 wrote to memory of 3156	984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe	71
PID 984 wrote to memory of 3156	984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe	71
PID 984 wrote to memory of 3156	984	ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe	71

C:\Users\Admin\AppData\Local\Temp\ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe
"C:\Users\Admin\AppData\Local\Temp\ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe
  "C:\Users\Admin\AppData\Local\Temp\ABRECHNUNGSRECHNUNG 267000863645.PPTXL.gz.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3156-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3156-5-0x0000000000400000-0x00000000004A2000-memory.dmp