Analysis
-
max time kernel
33s -
max time network
32s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 18:03
General
-
Target
917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0.exe
-
Size
104KB
-
MD5
d0e03def597d852dcb93458cfa596843
-
SHA1
6f907f8f731f84cdaf19f07abe2b02bd3975ebfd
-
SHA256
917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0
-
SHA512
8868b2ec512626b6d5a1e15453c66dea70c83f382c85be6281cd722b03cac8a4ce8248f7eaf08424267e314c9237842c84db2a4349467fe45d0c380166d4e278
Score
10/10
Malware Config
Signatures
-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0.exe"C:\Users\Admin\AppData\Local\Temp\917a18876b441d7d29a38eabd103fcb803cc73e8bd1307f2d36cf9738d6e68e0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1988-3-0x000007FEF6510000-0x000007FEF678A000-memory.dmpFilesize
2.5MB
-
memory/2044-2-0x0000000075251000-0x0000000075253000-memory.dmpFilesize
8KB