lokibot | 684a06bfc4c0bd7e437ddbe3cac4bf10eac0171f181adf09ba07244dffd592cd

Analysis

max time kernel
13s
max time network
117s
platform
windows10_x64
resource
win10v20201028
submitted
08/12/2020, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe
Size 164KB
Sample201208-zz4594fd5j
SHA256 684a06bfc4c0bd7e437ddbe3cac4bf10eac0171f181adf09ba07244dffd592cd
MD5 d55598ab69e9be83d40994ddbd4f6252
SHA1 67c9ecde1d590ebd5015f24851b27b74d061592c
SHA512 e45063d3e4ef98e73032239f311a73778eece0b5181edbb01f689195d5644cc645756abbdae2d107e7b7f718b783bb32a11e076ce3f1a01aa53fe4b2d30d845f
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://51.195.53.27/~dasdas/ff.php/HsSpKI8PLZu2g
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3976 set thread context of 64	3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe	73

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
64	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 64	3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe	73
PID 3976 wrote to memory of 64	3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe	73
PID 3976 wrote to memory of 64	3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe	73
PID 3976 wrote to memory of 64	3976	LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe	73

C:\Users\Admin\AppData\Local\Temp\LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\LIST OF REAP MEMBERS NOMINATED FOR ELECTION.pdf.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3976-4-0x00000000021E0000-0x0000000002282000-memory.dmp