lokibot | 61b69f7d85ced51c8f0aedc90a74cf60ceb166ee2b4eec7b0f559a8eda47ce48

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
02/12/2020, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad1324481f8f05b9249b833fef2d0110.exe
Size 642KB
Sample201202-5cthecndfx
SHA256 61b69f7d85ced51c8f0aedc90a74cf60ceb166ee2b4eec7b0f559a8eda47ce48
MD5 ad1324481f8f05b9249b833fef2d0110
SHA1 23feebf95b99d4f35b3d4c560b8c0acb20749d9d
SHA512 df484a3e159aed981afb1a688dbb2c9fd2096e4b565dd790ee591813b23bc4df3006e2711978dfcbac3b2fdcfdc63d47a3625029bb905a207440e233bbd08360
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://webtex.ga/rojas/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1928	ad1324481f8f05b9249b833fef2d0110.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	ad1324481f8f05b9249b833fef2d0110.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29
PID 1992 wrote to memory of 1928	1992	ad1324481f8f05b9249b833fef2d0110.exe	29

C:\Users\Admin\AppData\Local\Temp\ad1324481f8f05b9249b833fef2d0110.exe
"C:\Users\Admin\AppData\Local\Temp\ad1324481f8f05b9249b833fef2d0110.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\ad1324481f8f05b9249b833fef2d0110.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-10-0x000007FEF7020000-0x000007FEF729A000-memory.dmp

Download

memory/1928-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1928-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1992-2-0x0000000073AF0000-0x00000000741DE000-memory.dmp

Download

memory/1992-3-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/1992-5-0x0000000000390000-0x000000000039E000-memory.dmp

Download

memory/1992-6-0x0000000005A90000-0x0000000005B1C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads