Overview

overview

10

Static

static

0fc7bb462e...f7.exe

windows7_x64

10

0fc7bb462e...f7.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-01-2021 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fc7bb462e9828b1d1a8e6eb348496f7.exe

  • Size

    612KB

  • MD5

    0fc7bb462e9828b1d1a8e6eb348496f7

  • SHA1

    2960267bf2e2a31bf2874bda6bc638eb3d0c1d09

  • SHA256

    a8d610f19e96de89a6f0ca74140b1ce763cb5f2cf2755f17ed411f81eed9bf2f

  • SHA512

    a95d2b237c7cdfd74042bd9c8ff04436b4de5fe99bf10f4b9e23f4d95e0bb4000be4e6485cbb84056eaa462faa307d19573e6fb6a2f324cd009855462e9184d2

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://azzmtool.com/chief/offor/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc7bb462e9828b1d1a8e6eb348496f7.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc7bb462e9828b1d1a8e6eb348496f7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\0fc7bb462e9828b1d1a8e6eb348496f7.exe
      "C:\Users\Admin\AppData\Local\Temp\0fc7bb462e9828b1d1a8e6eb348496f7.exe"
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/756-10-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1088-2-0x0000000074CC0000-0x00000000753AE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1088-3-0x0000000001220000-0x0000000001221000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1088-5-0x00000000004E0000-0x00000000004F2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1088-6-0x0000000004960000-0x00000000049B8000-memory.dmp
    Filesize

    352KB

    Download
  • memory/1564-8-0x00000000004139DE-mapping.dmp
    Download
  • memory/1564-7-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1564-9-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download