lokibot | 917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0 | Triage

Resubmissions

18-01-2021 12:17

210118-m3kprw4xg6 10

Analysis

max time kernel
6s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
18-01-2021 12:17

Sharing

Report Analysis Logs

General

Target

Lokibot.bin.exe
Size

104KB
MD5

d0e03def597d852dcb93458cfa596843
SHA1

6f907f8f731f84cdaf19f07abe2b02bd3975ebfd
SHA256

917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0
SHA512

8868b2ec512626b6d5a1e15453c66dea70c83f382c85be6281cd722b03cac8a4ce8248f7eaf08424267e314c9237842c84db2a4349467fe45d0c380166d4e278

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Lokibot.bin.exe

pid process

1932 Lokibot.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Lokibot.bin.exe

description pid process

Token: SeDebugPrivilege 1932 Lokibot.bin.exe

C:\Users\Admin\AppData\Local\Temp\Lokibot.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Lokibot.bin.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1988-3-0x000007FEF6E90000-0x000007FEF710A000-memory.dmp

Filesize
2.5MB

Download