lokibot | 25b6f68e2bf505cfde67c533f5d12e869b30efe831fa82fd91c2c29f59fc77ac

Analysis

max time kernel
140s
max time network
141s
platform
windows10_x64
resource
win10v20210410
submitted
29/04/2021, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b43c829af2eb773a3614b02ba5b8c5f.exe
Size 638KB
Sample210429-h787km7a5a
SHA256 25b6f68e2bf505cfde67c533f5d12e869b30efe831fa82fd91c2c29f59fc77ac
MD5 0b43c829af2eb773a3614b02ba5b8c5f
SHA1 bc55a69ca1a72f9f0761112c05b3938aebad1c43
SHA512 b217e62b84ee1ff57bb71195a0758ead6821c3cd21b9d48b710cc0a972b2740001e87edeaa22dd10800446ec15733ef5fa51eb58f2ca6d3129b351d9d2c99402
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://amrp.tw/kayo/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3488	0b43c829af2eb773a3614b02ba5b8c5f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	0b43c829af2eb773a3614b02ba5b8c5f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78
PID 3968 wrote to memory of 3488	3968	0b43c829af2eb773a3614b02ba5b8c5f.exe	78

C:\Users\Admin\AppData\Local\Temp\0b43c829af2eb773a3614b02ba5b8c5f.exe
"C:\Users\Admin\AppData\Local\Temp\0b43c829af2eb773a3614b02ba5b8c5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\AppData\Local\Temp\0b43c829af2eb773a3614b02ba5b8c5f.exe
  "C:\Users\Admin\AppData\Local\Temp\0b43c829af2eb773a3614b02ba5b8c5f.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3488-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3968-121-0x0000000005140000-0x000000000563E000-memory.dmp

Download

memory/3968-119-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/3968-120-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/3968-114-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/3968-122-0x0000000005320000-0x000000000532D000-memory.dmp

Download

memory/3968-123-0x0000000000FE0000-0x0000000001050000-memory.dmp

Download

memory/3968-124-0x00000000010A0000-0x00000000010CE000-memory.dmp

Download

memory/3968-118-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/3968-117-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/3968-116-0x00000000050A0000-0x00000000050A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads