lokibot | c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a

Analysis

max time kernel
116s
max time network
118s
platform
windows7_x64
resource
win7v20201028
submitted
24/12/2020, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZJ6acgnEEcphF6n.exe
Size 448KB
Sample201224-c4myzescyx
SHA256 c844f3484e31450c39372bcc19ebc94bcff258fd03e8a59edf7b3acc3c91682a
MD5 0d1720971a5e9b59cfaec7984f29ab71
SHA1 ddbae5f05061bfb66aaaf66cb54d41965614991b
SHA512 5ae5a2e0151c87e1e345d139c49360e63da26952ca35ef1db41886f98aa151e3b83e14b8d5af2a6ed313b5e54c720fed4003d3c91a92c11f8bbed7e40e90c61c
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://azzmtool.com/kin/kin1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 828	1824	ZJ6acgnEEcphF6n.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
828	ZJ6acgnEEcphF6n.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	ZJ6acgnEEcphF6n.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29
PID 1824 wrote to memory of 828	1824	ZJ6acgnEEcphF6n.exe	29

C:\Users\Admin\AppData\Local\Temp\ZJ6acgnEEcphF6n.exe
"C:\Users\Admin\AppData\Local\Temp\ZJ6acgnEEcphF6n.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\ZJ6acgnEEcphF6n.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/828-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1300-10-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Download

memory/1824-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/1824-3-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/1824-5-0x0000000000750000-0x0000000000754000-memory.dmp

Download

memory/1824-6-0x0000000000DC0000-0x0000000000DF9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads