lokibot | 2f1a6b566dc0d2b8e5fcdcf67adc0be912f73fe14c27b262b610dfcd03cd4686

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads1/569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
Size

272KB
MD5

024cf2c94c771fffe32ec010d9fb786b
SHA1

028a67f1e497b2eede0a357a30bfd63dc7acaacb
SHA256

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046
SHA512

9724f44a8e7e8fdd67570afc3e14c52062f378a4e9d4e5ce3d87cc848cf43394ae583e478739b20a26cfbde5a1da01ce3346c18861e663e9d19157c27b514324

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://omann.ir/walex/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

description	pid	process	target process
PID 1964 set thread context of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

pid	process
1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

pid process

1128 569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

pid	process
1128	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

description	pid	process
Token: SeDebugPrivilege	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
Token: SeDebugPrivilege	1128	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

description	pid	process	target process
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
PID 1964 wrote to memory of 1128	1964	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe	569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe

C:\Users\Admin\AppData\Local\Temp\Downloads1\569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\Downloads1\569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\569c41122e32d220bfbaf714d360fa6238f44fe15dd398a5b4d2e05a57a02046.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1128-5-0x00000000004139DE-mapping.dmp

Download
memory/1128-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1320-7-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

Filesize
2.5MB

Download
memory/1964-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1964-3-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download