lokibot | cb0bb54b2ec784a7cd33736eabd462fae2fb9ab7c1f89a4a91300a0816f6db17

Analysis

max time kernel
134s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
05/02/2021, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b4431829c1d279e1f77cf9d3a4a05c9.exe
Size 972KB
Sample210205-gy2hckedd2
SHA256 cb0bb54b2ec784a7cd33736eabd462fae2fb9ab7c1f89a4a91300a0816f6db17
MD5 5b4431829c1d279e1f77cf9d3a4a05c9
SHA1 77e710349d44fbe8bde19439c63a81bbbefb1b00
SHA512 65163a0ddea42e28fee512fd83b3afe5fac63a3c0179a670fdd8c9eddf5ee5a15cb9c5ed00e1868493efde590ffed78a6edd7d4dee889c9cf5b6048c4b1f5b6a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://becharnise.ir/tws/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 496 set thread context of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2176	5b4431829c1d279e1f77cf9d3a4a05c9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	5b4431829c1d279e1f77cf9d3a4a05c9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78
PID 496 wrote to memory of 2176	496	5b4431829c1d279e1f77cf9d3a4a05c9.exe	78

C:\Users\Admin\AppData\Local\Temp\5b4431829c1d279e1f77cf9d3a4a05c9.exe
"C:\Users\Admin\AppData\Local\Temp\5b4431829c1d279e1f77cf9d3a4a05c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:496
- C:\Users\Admin\AppData\Local\Temp\5b4431829c1d279e1f77cf9d3a4a05c9.exe
  "C:\Users\Admin\AppData\Local\Temp\5b4431829c1d279e1f77cf9d3a4a05c9.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/496-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Download

memory/496-3-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/496-5-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/496-6-0x0000000005B60000-0x0000000005B61000-memory.dmp

Download

memory/496-7-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/496-8-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/496-9-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/496-10-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/496-11-0x0000000005820000-0x0000000005824000-memory.dmp

Download

memory/496-12-0x0000000001400000-0x0000000001447000-memory.dmp

Download

memory/2176-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2176-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads