lokibot | 7596f11c31683cc9137672d261e19b4dd61952bad97545080a1663ab475283b2

Analysis

max time kernel
126s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
21/12/2020, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ee960d7d595c82b47ce28164afed056.exe
Size 571KB
Sample201221-b8m45r6vc6
SHA256 7596f11c31683cc9137672d261e19b4dd61952bad97545080a1663ab475283b2
MD5 3ee960d7d595c82b47ce28164afed056
SHA1 fd750607c392744a3302538c2a0b0fe810d199bb
SHA512 f5432d376f7390c3a4ead25cd167286fb9b99421354302aff7739b30ab2df825eae16d05de1308268df27b60b01f8150a42707c7b6367a5d051e0ad443a49462
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://begadi.ga/chud/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2268	3ee960d7d595c82b47ce28164afed056.exe
2268	3ee960d7d595c82b47ce28164afed056.exe
2268	3ee960d7d595c82b47ce28164afed056.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
192	3ee960d7d595c82b47ce28164afed056.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	3ee960d7d595c82b47ce28164afed056.exe
Token: SeDebugPrivilege	192	3ee960d7d595c82b47ce28164afed056.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78
PID 2268 wrote to memory of 192	2268	3ee960d7d595c82b47ce28164afed056.exe	78

C:\Users\Admin\AppData\Local\Temp\3ee960d7d595c82b47ce28164afed056.exe
"C:\Users\Admin\AppData\Local\Temp\3ee960d7d595c82b47ce28164afed056.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\3ee960d7d595c82b47ce28164afed056.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/192-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2268-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Download

memory/2268-3-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/2268-5-0x0000000007E50000-0x0000000007E51000-memory.dmp

Download

memory/2268-6-0x00000000083F0000-0x00000000083F1000-memory.dmp

Download

memory/2268-7-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Download

memory/2268-8-0x000000000B4B0000-0x000000000B4B1000-memory.dmp

Download

memory/2268-9-0x00000000080C0000-0x00000000080C4000-memory.dmp

Download

memory/2268-10-0x0000000009C00000-0x0000000009C58000-memory.dmp

Download