lokibot | e331f7d7d599c56a3ee8e0900c335444637c6a99d8eec4f1bd49fdcb1d132dc0

Analysis

max time kernel
127s
max time network
127s
platform
windows10_x64
resource
win10v20201028
submitted
01/12/2020, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice.exe
Size 654KB
Sample201201-ftwts2syln
SHA256 e331f7d7d599c56a3ee8e0900c335444637c6a99d8eec4f1bd49fdcb1d132dc0
MD5 fa283ee3d8e3cb131c67af1feb1a39cd
SHA1 62cf272f4de9854e6d2e642a4d0c23abd59cab0c
SHA512 2d9cdd0232193f211978c9dbfda352ead768d294f360f2c7187d47d8e0380477729041059a82e7a2805c004c81ba84649d67abc3c1ae332362166fa7c9a840f5
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://104.168.146.103/eXcessBLESSINGforTheBoy/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 3940	640	Invoice.exe	74

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
640	Invoice.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3940	Invoice.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	Invoice.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3940	640	Invoice.exe	74
PID 640 wrote to memory of 3940	640	Invoice.exe	74
PID 640 wrote to memory of 3940	640	Invoice.exe	74
PID 640 wrote to memory of 3940	640	Invoice.exe	74

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\Invoice.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-4-0x0000000002310000-0x00000000023B2000-memory.dmp

Download

memory/3940-2-0x0000000000400000-0x00000000004A2000-memory.dmp