lokibot | 8f91fd63bcc2d757496490b2680d0c8bdfe0d9c89c95275fca0f75a55cc9c4a7

Analysis

max time kernel
128s
max time network
129s
platform
windows7_x64
resource
win7v20201028
submitted
07/12/2020, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7ff0404b2597c12652a48961d210a75.exe
Size 723KB
Sample201207-2retdc9xca
SHA256 8f91fd63bcc2d757496490b2680d0c8bdfe0d9c89c95275fca0f75a55cc9c4a7
MD5 a7ff0404b2597c12652a48961d210a75
SHA1 a79b7b7fa24bd0ccfe7cb58b8a5b6c6f6eee8563
SHA512 01b7ffe6adc666bab6ea85d76f79add661f6b3ff48e1c019fd26647eb47e988eee29dc60424a368abfc9cc50fb8a1042abb4bc582bfbd53e028bf67f43cd23e2
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://webtex.ga/rojas/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1592	a7ff0404b2597c12652a48961d210a75.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	a7ff0404b2597c12652a48961d210a75.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29
PID 800 wrote to memory of 1592	800	a7ff0404b2597c12652a48961d210a75.exe	29

C:\Users\Admin\AppData\Local\Temp\a7ff0404b2597c12652a48961d210a75.exe
"C:\Users\Admin\AppData\Local\Temp\a7ff0404b2597c12652a48961d210a75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\a7ff0404b2597c12652a48961d210a75.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-2-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Download

memory/800-3-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/800-5-0x00000000005F0000-0x00000000005FE000-memory.dmp

Download

memory/800-6-0x0000000007FC0000-0x000000000804E000-memory.dmp

Download

memory/1592-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1592-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1616-10-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads