Overview

overview

10

Static

static

DOC0043999...at.exe

windows7_x64

10

DOC0043999...at.exe

windows10_x64

10

Analysis

  • max time kernel
    67s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-01-2021 07:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DOC0043999675.PDF.bat.exe

  • Size

    891KB

  • MD5

    25fdf23ec9f72498ac683767c12a5145

  • SHA1

    363b35fcb7aa46f536f531ce9c3c1fccacb96e0c

  • SHA256

    91f8ad08e33830df10bedd519ccbfc3d910a6456ac964e1e6871838b9558e599

  • SHA512

    decb4796c57ed86d08fedfdefdc2ba082222b1f983d891cd36d0af1dfefa625ed0f5ae385dbdc8d65e785cfa8edb1f0d76cf777216040e81e565f483ed88162e

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/dklX59XNxRkB6

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOC0043999675.PDF.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\DOC0043999675.PDF.bat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\DOC0043999675.PDF.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\DOC0043999675.PDF.bat.exe"
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1052-2-0x0000000074570000-0x0000000074C5E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1052-3-0x0000000000F00000-0x0000000000F01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1052-5-0x0000000000220000-0x0000000000232000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1052-6-0x00000000043F0000-0x0000000004443000-memory.dmp
    Filesize

    332KB

    Download
  • memory/1316-7-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1316-8-0x00000000004139DE-mapping.dmp
    Download
  • memory/1316-9-0x0000000000400000-0x00000000004A2000-memory.dmp
    Filesize

    648KB

    Download
  • memory/1496-10-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp
    Filesize

    2.5MB

    Download