lokibot | cc7d19e6c4fcae8326db313f78e56ad4e9f7346912c2f4d909e3620c1c22147f

Analysis

max time kernel
129s
max time network
132s
platform
windows10_x64
resource
win10v20201028
submitted
19/01/2021, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_06176.pdf.exe
Size 1.2MB
Sample210119-7xt7xhxc8a
SHA256 cc7d19e6c4fcae8326db313f78e56ad4e9f7346912c2f4d909e3620c1c22147f
MD5 af5e99b838ae10dbc1e7cedc58413b06
SHA1 8cc2502633ad3e74fd8cde8e0d9e39b74d0301bd
SHA512 b79a186c53cef1b88b7e3cc8ba82a7c4e7b704b4a985bcadfa6dd42fb53bc057de76e401b475368d1d1feb1e0e8b7f36d1524e3918018f6a36b5e397a9c52aaf
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://185.206.215.56/r-1/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
3252	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 3252	4764	IMG_06176.pdf.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4764	IMG_06176.pdf.exe
4764	IMG_06176.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	IMG_06176.pdf.exe
Token: SeDebugPrivilege	3252	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75
PID 4764 wrote to memory of 3252	4764	IMG_06176.pdf.exe	75

C:\Users\Admin\AppData\Local\Temp\IMG_06176.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_06176.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3252-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3252-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4764-9-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/4764-2-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/4764-10-0x0000000008370000-0x000000000837B000-memory.dmp

Download

memory/4764-11-0x000000000B820000-0x000000000B821000-memory.dmp

Download

memory/4764-12-0x0000000005171000-0x0000000005172000-memory.dmp

Download

memory/4764-8-0x00000000078E0000-0x00000000078E1000-memory.dmp

Download

memory/4764-7-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/4764-6-0x0000000004EE0000-0x0000000004EFE000-memory.dmp

Download

memory/4764-5-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/4764-3-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download