lokibot | 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
18/12/2020, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order (076_20_186).exe
Size 1.0MB
Sample201218-5f13asp6kx
SHA256 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403
MD5 6d75ee651594004f9e21da4ff9b498c9
SHA1 b024ed0f39ae4731d3bd97ed8046248b906b2199
SHA512 14d3e6175604202e20f99e6087749353ce358901fc52fc7913cbcebb4dcaed67061fcf8abce324daa02a162522215be61de6003f7f0ba069689b76c5da218f8b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://tradesgroups.com/bin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 1352	1008	order (076_20_186).exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	order (076_20_186).exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	order (076_20_186).exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1352	order (076_20_186).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	order (076_20_186).exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29
PID 1008 wrote to memory of 1352	1008	order (076_20_186).exe	29

C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe
"C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe
  "C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-5-0x000007FEF7570000-0x000007FEF77EA000-memory.dmp

Download

memory/1352-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1352-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads