lokibot | d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc

Analysis

max time kernel
40s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
20-02-2021 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
Size

506KB
MD5

87f2e974ce1409d31ff4357ca83cdc51
SHA1

896d62c4d3c728d11c2122ede992a3359840b85e
SHA256

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287
SHA512

7a91f4f38bac4ebe588d90d365d8afc6f295c1871e27d47f2cf1525871e5cc57fc186b397212cce59044597b8d44a5ab4b643c07bc281e5597f03063e6a09196

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://51.195.53.221/p.php/7gEWZ4upg1lkl

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

description	pid	process	target process
PID 360 set thread context of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

pid process

360 1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

pid process

2660 1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

pid	process
360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

pid	process
2660	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

description	pid	process
Token: SeDebugPrivilege	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
Token: SeDebugPrivilege	2660	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

description	pid	process	target process
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
PID 360 wrote to memory of 2660	360	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe	1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe

C:\Users\Admin\AppData\Local\Temp\1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
"C:\Users\Admin\AppData\Local\Temp\1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360
- C:\Users\Admin\AppData\Local\Temp\1b729638fb6cebf16ff6dc59c6144123367649b1ae68b50404a20678d6344287.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-2-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/360-3-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/360-5-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/360-6-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/360-7-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/360-8-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/360-9-0x0000000008910000-0x0000000008911000-memory.dmp

Filesize
4KB

Download
memory/360-10-0x0000000005840000-0x000000000584B000-memory.dmp

Filesize
44KB

Download
memory/360-11-0x00000000089B0000-0x0000000008A1E000-memory.dmp

Filesize
440KB

Download
memory/2660-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2660-13-0x00000000004139DE-mapping.dmp

Download
memory/2660-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download