lokibot | ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a

Analysis

max time kernel
110s
max time network
143s
platform
windows7_x64
resource
win7v20210410
submitted
02/07/2021, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8f5b3bad883e0b62fed5af138449db6.exe
Size 727KB
Sample210702-aecdpgyees
SHA256 ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a
MD5 f8f5b3bad883e0b62fed5af138449db6
SHA1 a09c250244420c43e83433d2a54a784b1400417a
SHA512 bf325530600b0211039872b5a7b1796c5f802d7eaeaac66b5ca1b92d5b3f2db3f5776fe453cdf2f7e6434fc36b7a8bbe035566036244209cfab546ec514b36c3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://manvim.co/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1016	f8f5b3bad883e0b62fed5af138449db6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	f8f5b3bad883e0b62fed5af138449db6.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29
PID 1652 wrote to memory of 1016	1652	f8f5b3bad883e0b62fed5af138449db6.exe	29

C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
"C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe
  "C:\Users\Admin\AppData\Local\Temp\f8f5b3bad883e0b62fed5af138449db6.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1016-67-0x0000000075411000-0x0000000075413000-memory.dmp

Download

memory/1016-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1652-59-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/1652-61-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/1652-62-0x000000000A030000-0x000000000C02F000-memory.dmp

Download

memory/1652-63-0x0000000005650000-0x00000000056B2000-memory.dmp

Download

memory/1652-64-0x0000000000410000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads