lokibot | 3deeb55fefe05f51c41b1724780e5de1e33a432e01f455e3ab5d2af5ca655464 | Triage

Analysis

max time kernel
142s
max time network
158s
platform
windows10_x64
resource
win10v20210410
submitted
08-06-2021 19:33

Sharing

Report Analysis Logs

General

Target

unpacked.bin.exe
Size

104KB
MD5

1917f888cacd48b9a8d4832449e8d34f
SHA1

d732e6a78ea44b77943c1e74e19c9ea92d0b7a28
SHA256

3deeb55fefe05f51c41b1724780e5de1e33a432e01f455e3ab5d2af5ca655464
SHA512

901b095813605c89945e1b5354fef210b0a68d94a79156b5d405116c5f00a15571046a0e9d65830cdaea8a3deda657a6d4ac6744ecef30cca6b26033d8b61b55

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: RenamesItself 1 IoCs

Processes:

unpacked.bin.exe

pid process

4460 unpacked.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

unpacked.bin.exe

description pid process

Token: SeDebugPrivilege 4460 unpacked.bin.exe

C:\Users\Admin\AppData\Local\Temp\unpacked.bin.exe
"C:\Users\Admin\AppData\Local\Temp\unpacked.bin.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...