lokibot | e1797184663ac087b1641a5f2313f1d7dc2d9d0a0f5d0099a478dd52531bf13b | Triage

Analysis

max time kernel
130s
max time network
138s
platform
windows10_x64
resource
win10v20210408
submitted
24-06-2021 06:01

Sharing

Report Analysis Logs

General

Target

proforma invoicepdf.exe
Size

358KB
MD5

9962660f061cfa2cc47527ab5a7e87f0
SHA1

ccc0ecaeb700427d8f2435457598b4fab27f029d
SHA256

e1797184663ac087b1641a5f2313f1d7dc2d9d0a0f5d0099a478dd52531bf13b
SHA512

419a71717d33a956367c64210fcfa2a638bf3803532306417cb527215e9ec620f8798f47dccad18ee313d1b1aace22dd0e2f7aab1dc22e1390c3021eaccddc58

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd6/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: RenamesItself 1 IoCs

Processes:

proforma invoicepdf.exe

pid process

800 proforma invoicepdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

proforma invoicepdf.exe

description pid process

Token: SeDebugPrivilege 800 proforma invoicepdf.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoicepdf.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoicepdf.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-115-0x0000000000400000-0x00000000008F8000-memory.dmp

Filesize
5.0MB

Download
memory/800-114-0x0000000002630000-0x000000000264B000-memory.dmp

Filesize
108KB

Download