lokibot | 6329c43eca50953976efaccaa18465ed3f7e77bb2b8e7f52b16a3fc0a23cadcd

Analysis

max time kernel
140s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
28/01/2021, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3ePixq21DuQoYE.exe
Size 812KB
Sample210128-v6ep9ln5ea
SHA256 6329c43eca50953976efaccaa18465ed3f7e77bb2b8e7f52b16a3fc0a23cadcd
MD5 d1b2dbcfd93f09e2d62fb5cff61da4bf
SHA1 f926668cdc495d7c969dd90518e17f236440feae
SHA512 2e7b16934a3e97a312dbb0740a14de1f23b300d04f8e2dcbb4ae872d7644c48aa0be29d917dc9e6700a3ffc593c0209786e317c731626bf997ba7c3479d072f3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://becharnise.ir/twp/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 512	4768	d3ePixq21DuQoYE.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
512	d3ePixq21DuQoYE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	d3ePixq21DuQoYE.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78
PID 4768 wrote to memory of 512	4768	d3ePixq21DuQoYE.exe	78

C:\Users\Admin\AppData\Local\Temp\d3ePixq21DuQoYE.exe
"C:\Users\Admin\AppData\Local\Temp\d3ePixq21DuQoYE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\d3ePixq21DuQoYE.exe
  "C:\Users\Admin\AppData\Local\Temp\d3ePixq21DuQoYE.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/512-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4768-9-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/4768-7-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/4768-8-0x00000000051C0000-0x00000000051C1000-memory.dmp

Download

memory/4768-2-0x00000000732D0000-0x00000000739BE000-memory.dmp

Download

memory/4768-10-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Download

memory/4768-11-0x0000000005750000-0x0000000005753000-memory.dmp

Download

memory/4768-12-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/4768-13-0x0000000006360000-0x00000000063EE000-memory.dmp

Download

memory/4768-6-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/4768-5-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/4768-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads