lokibot | 40c6722729a64ec203376f1376ad52dec8efcf0d5a47abd8019009d799f2f97c

Analysis

max time kernel
118s
max time network
118s
platform
windows10_x64
resource
win10v20201028
submitted
23/03/2021, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2016efd23d991477b03728e2013d9a8d.exe
Size 875KB
Sample210323-yf73n2dad6
SHA256 40c6722729a64ec203376f1376ad52dec8efcf0d5a47abd8019009d799f2f97c
MD5 2016efd23d991477b03728e2013d9a8d
SHA1 fcc10b79999705a0fabbfd2beafc756b2e6295b6
SHA512 c3cbb826977d86813166e4d65d5c4328ad89e842bf5611d10b98f242d2ebb7c2a6d3c9e2cd5bbc6edd2541d65d409937dfcb508e33491f5134bb32d20b923470
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://transcorpoil.us/ken/kaka/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3996 set thread context of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3824	2016efd23d991477b03728e2013d9a8d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	2016efd23d991477b03728e2013d9a8d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78
PID 3996 wrote to memory of 3824	3996	2016efd23d991477b03728e2013d9a8d.exe	78

C:\Users\Admin\AppData\Local\Temp\2016efd23d991477b03728e2013d9a8d.exe
"C:\Users\Admin\AppData\Local\Temp\2016efd23d991477b03728e2013d9a8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\2016efd23d991477b03728e2013d9a8d.exe
  "C:\Users\Admin\AppData\Local\Temp\2016efd23d991477b03728e2013d9a8d.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3824-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3824-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3996-9-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/3996-7-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/3996-8-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/3996-2-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/3996-10-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download

memory/3996-11-0x0000000004D20000-0x0000000004D2B000-memory.dmp

Download

memory/3996-12-0x0000000005A60000-0x0000000005AD5000-memory.dmp

Download

memory/3996-6-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/3996-5-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/3996-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads