lokibot | aa548ddf32b2ee6bca356a8e8e98e9b12e33519f2285fbcafa3ab6604943e8f7

Analysis

max time kernel
140s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
29/01/2021, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
880b987607e4a382fc7e8364a36872ad.exe
Size 680KB
Sample210129-evvmwdvdp2
SHA256 aa548ddf32b2ee6bca356a8e8e98e9b12e33519f2285fbcafa3ab6604943e8f7
MD5 880b987607e4a382fc7e8364a36872ad
SHA1 0fee19bae1ad0e2b096bc3032f766a68ab805286
SHA512 2d89fc83f4c9655b71055681293fc67b648e381e5d589224ee124c70e32bc91de06018b4e90f2fee750e93b87fd629d08b7844d3ceb5b0ba6dd03664b0ce2ee0
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://becharnise.ir/fa9/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4040	880b987607e4a382fc7e8364a36872ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	880b987607e4a382fc7e8364a36872ad.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79
PID 580 wrote to memory of 4040	580	880b987607e4a382fc7e8364a36872ad.exe	79

C:\Users\Admin\AppData\Local\Temp\880b987607e4a382fc7e8364a36872ad.exe
"C:\Users\Admin\AppData\Local\Temp\880b987607e4a382fc7e8364a36872ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\880b987607e4a382fc7e8364a36872ad.exe
  "C:\Users\Admin\AppData\Local\Temp\880b987607e4a382fc7e8364a36872ad.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/580-3-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/580-5-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/580-6-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/580-7-0x0000000005000000-0x0000000005001000-memory.dmp

Download

memory/580-8-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/580-9-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/580-10-0x00000000051B0000-0x00000000051B3000-memory.dmp

Download

memory/580-11-0x00000000051C0000-0x00000000051C1000-memory.dmp

Download

memory/580-12-0x0000000005C50000-0x0000000005CA0000-memory.dmp

Download

memory/4040-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4040-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads