lokibot | 4b6ee615bf81f53ae678c3430249da8578e2fd2d2026a36ec3993cf8fbf8f70d

Analysis

max time kernel
130s
max time network
131s
platform
windows10_x64
resource
win10v20210408
submitted
04/05/2021, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c59ebb166d97d070ab571149524a1a84.exe
Size 2.1MB
Sample210504-h44vxv54l2
SHA256 4b6ee615bf81f53ae678c3430249da8578e2fd2d2026a36ec3993cf8fbf8f70d
MD5 c59ebb166d97d070ab571149524a1a84
SHA1 2b1dc28dc388dce8b0692a66b8a2c60e720c3235
SHA512 4d0fc509508c8627e1635ff23083f6912bbdb0325dcf29edfffd391caac8adda034462e7e77bf3cf0a3d91447758228835ddfcb9049b65ae0183921e91fcc147
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://173.208.204.37/k.php/mvM4bZPtu0I2s
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2076	c59ebb166d97d070ab571149524a1a84.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	c59ebb166d97d070ab571149524a1a84.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78
PID 644 wrote to memory of 2076	644	c59ebb166d97d070ab571149524a1a84.exe	78

C:\Users\Admin\AppData\Local\Temp\c59ebb166d97d070ab571149524a1a84.exe
"C:\Users\Admin\AppData\Local\Temp\c59ebb166d97d070ab571149524a1a84.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\c59ebb166d97d070ab571149524a1a84.exe
  "C:\Users\Admin\AppData\Local\Temp\c59ebb166d97d070ab571149524a1a84.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-114-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/644-116-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/644-117-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/644-118-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/644-119-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/644-120-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/644-121-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/644-122-0x0000000004EE0000-0x0000000004EEE000-memory.dmp

Download

memory/644-123-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/644-124-0x0000000000A70000-0x0000000000A92000-memory.dmp

Download

memory/2076-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2076-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads