lokibot | 44df96504ff0a727740da2a67982e2d214849ecf98a64de1ffcbf92bb46331a1

Analysis

max time kernel
15s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
28/07/2021, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transfer Request_pdf.gz.exe
Size 257KB
Sample210728-22cde2d7sx
SHA256 44df96504ff0a727740da2a67982e2d214849ecf98a64de1ffcbf92bb46331a1
MD5 76e63cbd970c7a019e3bc4bb409f0606
SHA1 5d4c5632dab2fa18942dc910ec3c5731d488aa83
SHA512 9dad45e1d26ce496d2e352523b9d3e9ee02db82ec338c425dcccbb73acd203a72a398a0ea5d5a04483e2a1a2180799949bb0c5b010e137ee3cad67ab8acf2061
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://185.227.139.18/dsaicosaicasdi.php/rVXhi7NTm83H7
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 2448	632	Transfer Request_pdf.gz.exe	72

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
632	Transfer Request_pdf.gz.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2448	Transfer Request_pdf.gz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	Transfer Request_pdf.gz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2448	632	Transfer Request_pdf.gz.exe	72
PID 632 wrote to memory of 2448	632	Transfer Request_pdf.gz.exe	72
PID 632 wrote to memory of 2448	632	Transfer Request_pdf.gz.exe	72
PID 632 wrote to memory of 2448	632	Transfer Request_pdf.gz.exe	72

C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.gz.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.gz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.gz.exe
  "C:\Users\Admin\AppData\Local\Temp\Transfer Request_pdf.gz.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-114-0x0000000001020000-0x0000000001022000-memory.dmp

Download

memory/2448-116-0x0000000000400000-0x00000000004A2000-memory.dmp