lokibot | fe7479e0f85f368fe788c73b89e703e9b3d1885df1b304f8d7b2fcfe14a067a0

Analysis

max time kernel
108s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
20/04/2021, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cef1e0b924d0a3c707a56b83fde27470.exe
Size 982KB
Sample210420-ntvdtfk3vs
SHA256 fe7479e0f85f368fe788c73b89e703e9b3d1885df1b304f8d7b2fcfe14a067a0
MD5 cef1e0b924d0a3c707a56b83fde27470
SHA1 2f4faa0a66a7cb56a2ff341b95efbc14b5a6aa41
SHA512 09875123dd1080af0cedb52385560f2f4e1f042befbdb2b4eabb267c2e92fa8877043862ceff97751e5ed05a33fd4c36b9f7b958e9b7129cbe992ecd6b714233
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://amrp.tw/engr/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3224	cef1e0b924d0a3c707a56b83fde27470.exe
3224	cef1e0b924d0a3c707a56b83fde27470.exe
3224	cef1e0b924d0a3c707a56b83fde27470.exe
3224	cef1e0b924d0a3c707a56b83fde27470.exe
3224	cef1e0b924d0a3c707a56b83fde27470.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4044	cef1e0b924d0a3c707a56b83fde27470.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	cef1e0b924d0a3c707a56b83fde27470.exe
Token: SeDebugPrivilege	4044	cef1e0b924d0a3c707a56b83fde27470.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4036	3224	cef1e0b924d0a3c707a56b83fde27470.exe	79
PID 3224 wrote to memory of 4036	3224	cef1e0b924d0a3c707a56b83fde27470.exe	79
PID 3224 wrote to memory of 4036	3224	cef1e0b924d0a3c707a56b83fde27470.exe	79
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80
PID 3224 wrote to memory of 4044	3224	cef1e0b924d0a3c707a56b83fde27470.exe	80

C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe
"C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe
  "C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe"
  2⤵
  PID:4036
- C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe
  "C:\Users\Admin\AppData\Local\Temp\cef1e0b924d0a3c707a56b83fde27470.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:4044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-114-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3224-116-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/3224-117-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/3224-118-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/3224-119-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/3224-120-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/3224-121-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/3224-122-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/3224-123-0x00000000060C0000-0x00000000060C9000-memory.dmp

Download

memory/3224-124-0x000000007FAB0000-0x000000007FAB1000-memory.dmp

Download

memory/3224-125-0x0000000001130000-0x00000000011A3000-memory.dmp

Download

memory/3224-126-0x0000000000DD0000-0x0000000000E00000-memory.dmp

Download

memory/4044-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4044-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Download