lokibot | 94341921ce426d705d027fafe0d22df5b4a9234e544f1dbbbd9f6858b5c9daaf

Analysis

max time kernel
113s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
10/12/2020, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FWSoOkisTysdyTr.exe
Size 474KB
Sample201210-8d98g72y2n
SHA256 94341921ce426d705d027fafe0d22df5b4a9234e544f1dbbbd9f6858b5c9daaf
MD5 1170578f5b1ba09cd66681ec545a65d2
SHA1 16e3166a6565d2f0ac2cdc7b80e4c3c28ca0d5db
SHA512 bf9a4deb5e38980ac6302a19669d38b2cd173fd7222ad09668129aa4a326cad989736644256e433c7a181036815b3c055a03dfcd9548915a786a054eed7550ce
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://37.46.150.41/22/2/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 1468	3992	FWSoOkisTysdyTr.exe	78

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3992	FWSoOkisTysdyTr.exe
3992	FWSoOkisTysdyTr.exe
3992	FWSoOkisTysdyTr.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1468	FWSoOkisTysdyTr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	FWSoOkisTysdyTr.exe
Token: SeDebugPrivilege	1468	FWSoOkisTysdyTr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78
PID 3992 wrote to memory of 1468	3992	FWSoOkisTysdyTr.exe	78

C:\Users\Admin\AppData\Local\Temp\FWSoOkisTysdyTr.exe
"C:\Users\Admin\AppData\Local\Temp\FWSoOkisTysdyTr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\FWSoOkisTysdyTr.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1468-18-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3992-12-0x000000000A590000-0x000000000A591000-memory.dmp

Download

memory/3992-9-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download

memory/3992-11-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/3992-2-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/3992-13-0x0000000008A60000-0x0000000008A6E000-memory.dmp

Download

memory/3992-14-0x0000000005E40000-0x0000000005E93000-memory.dmp

Download

memory/3992-15-0x0000000008BD0000-0x0000000008BD1000-memory.dmp

Download

memory/3992-6-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/3992-5-0x0000000004D30000-0x0000000004D7B000-memory.dmp

Download

memory/3992-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download