lokibot | e64b1e190d0586b444ffe00c8000df55893cb86939db1bad73d4b5449586973b

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
09/03/2021, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PL.exe
Size 1.2MB
Sample210309-8tkc2c5b32
SHA256 e64b1e190d0586b444ffe00c8000df55893cb86939db1bad73d4b5449586973b
MD5 c3260321a6cc95d3c81b7e3e36d432aa
SHA1 052a306146265a6810244b8ebdc5052fbe26ce36
SHA512 db6a5347ab421064f35f5cf8de571da2998b36e1bc4af368c88d4e839366e03283573e16ef03c8462c1fa4c060d2d7215eb36c2367183be28b5e0075a5b08c46
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://bremileintl.ga/maka/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 928	1968	PL.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
928	PL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	PL.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29
PID 1968 wrote to memory of 928	1968	PL.exe	29

C:\Users\Admin\AppData\Local\Temp\PL.exe
"C:\Users\Admin\AppData\Local\Temp\PL.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\PL.exe
  "C:\Users\Admin\AppData\Local\Temp\PL.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-7-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

Download

memory/928-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/928-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1968-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Download

memory/1968-3-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/1968-8-0x0000000000AF1000-0x0000000000AF2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads