lokibot | e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494

Analysis

max time kernel
128s
max time network
126s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c94c9b142cbf67442ee7bca8f7a9297.exe
Size 444KB
Sample210331-rw1x6hdjs2
SHA256 e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494
MD5 5c94c9b142cbf67442ee7bca8f7a9297
SHA1 8e91587bde86439832af2802c8c2f060d58e1aea
SHA512 0a681ee8114bfb0c94f95b452c1628efac6e8262fbc4967512ab06b3c1a844f215dcbcc625adc9ffe49111835fb0dc9f2d74e84ad6271b8f6167856bcae67831
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://msslrsa-motherson.com/coco/coco4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 328 set thread context of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
328	5c94c9b142cbf67442ee7bca8f7a9297.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1084	5c94c9b142cbf67442ee7bca8f7a9297.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	328	5c94c9b142cbf67442ee7bca8f7a9297.exe
Token: SeDebugPrivilege	1084	5c94c9b142cbf67442ee7bca8f7a9297.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29
PID 328 wrote to memory of 1084	328	5c94c9b142cbf67442ee7bca8f7a9297.exe	29

C:\Users\Admin\AppData\Local\Temp\5c94c9b142cbf67442ee7bca8f7a9297.exe
"C:\Users\Admin\AppData\Local\Temp\5c94c9b142cbf67442ee7bca8f7a9297.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328
- C:\Users\Admin\AppData\Local\Temp\5c94c9b142cbf67442ee7bca8f7a9297.exe
  "C:\Users\Admin\AppData\Local\Temp\5c94c9b142cbf67442ee7bca8f7a9297.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Download

memory/328-3-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/328-5-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/328-6-0x0000000000410000-0x0000000000419000-memory.dmp

Download

memory/328-7-0x00000000042F0000-0x0000000004338000-memory.dmp

Download

memory/1084-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1084-10-0x00000000761E1000-0x00000000761E3000-memory.dmp

Download

memory/1084-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1560-11-0x000007FEF81B0000-0x000007FEF842A000-memory.dmp

Download