lokibot | 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403

Analysis

max time kernel
66s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
18/12/2020, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order (076_20_186).exe
Size 1.0MB
Sample201218-5f13asp6kx
SHA256 59ec86c8b18a331a2679a555114120a087f3eddfb828dd815fd09748ed9e8403
MD5 6d75ee651594004f9e21da4ff9b498c9
SHA1 b024ed0f39ae4731d3bd97ed8046248b906b2199
SHA512 14d3e6175604202e20f99e6087749353ce358901fc52fc7913cbcebb4dcaed67061fcf8abce324daa02a162522215be61de6003f7f0ba069689b76c5da218f8b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://tradesgroups.com/bin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 2680	4092	order (076_20_186).exe	78

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	order (076_20_186).exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	order (076_20_186).exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2680	order (076_20_186).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2680	order (076_20_186).exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78
PID 4092 wrote to memory of 2680	4092	order (076_20_186).exe	78

C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe
"C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe
  "C:\Users\Admin\AppData\Local\Temp\order (076_20_186).exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2680-4-0x0000000000400000-0x00000000004A2000-memory.dmp