lokibot | 3d9b59ef7e396dcbfbb58069b1876d6b85e111c7e36b6a302cf4e955fb711a29

Analysis

max time kernel
137s
max time network
139s
platform
windows10_x64
resource
win10v20201028
submitted
25/01/2021, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 716KB
Sample210125-t2e2a7g8ws
SHA256 3d9b59ef7e396dcbfbb58069b1876d6b85e111c7e36b6a302cf4e955fb711a29
MD5 50d6f54a6c3960691d3fa0e2aeab617a
SHA1 07126be8eb554c31ecc91fc24e06d78ebdb1e115
SHA512 84ee7f53fb1897765ff820b2afcad90f78ed80c3356b86073dc56732c58bbaeb75f52804e632d5576ea9ffb818f4edc2a0e96ea8a09297ea5f981580e0f4dbf2
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://185.206.215.56/r-1/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
3608	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3084 set thread context of 3608	3084	file.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3084	file.exe
3084	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	file.exe
Token: SeDebugPrivilege	3608	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75
PID 3084 wrote to memory of 3608	3084	file.exe	75

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-10-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Download

memory/3084-6-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/3084-8-0x00000000061C0000-0x00000000061DE000-memory.dmp

Download

memory/3084-9-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/3084-2-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/3084-11-0x00000000057C1000-0x00000000057C2000-memory.dmp

Download

memory/3084-12-0x00000000092D0000-0x00000000092DB000-memory.dmp

Download

memory/3084-13-0x00000000092E0000-0x00000000092E1000-memory.dmp

Download

memory/3084-5-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/3084-3-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3608-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3608-17-0x0000000000400000-0x00000000004A2000-memory.dmp

Download