lokibot | bf72228e33b1514ef0c252e9963d6472e99466656b6125c8a560a9e66e9d6d17

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7v20201028
submitted
29/12/2020, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BB9B7493DD0A89B833547E082BC66761.exe
Size 613KB
Sample201229-lblefmcl1x
SHA256 bf72228e33b1514ef0c252e9963d6472e99466656b6125c8a560a9e66e9d6d17
MD5 bb9b7493dd0a89b833547e082bc66761
SHA1 af71d2079955315751b7d9ec23d80b7fe3ea4317
SHA512 21acce068ac5d621349f4663522b0eeabf89a80027c8273ee10f8a3c8315f9028e748234022b9dbc6e31dbee7a8591fcb45a5b68e32c72b49d24c1c4128798ca
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://79.124.8.6/plesk-site-preview/bosungind-kr.co/https/79.124.8.6/msn/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1756	BB9B7493DD0A89B833547E082BC66761.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1428	BB9B7493DD0A89B833547E082BC66761.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	BB9B7493DD0A89B833547E082BC66761.exe
Token: SeDebugPrivilege	1428	BB9B7493DD0A89B833547E082BC66761.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29
PID 1756 wrote to memory of 1428	1756	BB9B7493DD0A89B833547E082BC66761.exe	29

C:\Users\Admin\AppData\Local\Temp\BB9B7493DD0A89B833547E082BC66761.exe
"C:\Users\Admin\AppData\Local\Temp\BB9B7493DD0A89B833547E082BC66761.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\BB9B7493DD0A89B833547E082BC66761.exe
  "C:\Users\Admin\AppData\Local\Temp\BB9B7493DD0A89B833547E082BC66761.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-11-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmp

Download

memory/1428-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1428-10-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1756-2-0x00000000749D0000-0x00000000750BE000-memory.dmp

Download

memory/1756-3-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/1756-5-0x00000000002E0000-0x00000000002E6000-memory.dmp

Download

memory/1756-6-0x0000000004D00000-0x0000000004D5B000-memory.dmp

Download

memory/1756-7-0x0000000000B40000-0x0000000000B7A000-memory.dmp

Download