lokibot | dbadb8a0f9e9085409ebaf01c9a2af057597b2bbf5b8ecdef2f1c5601cdfedc1

Analysis

max time kernel
14s
max time network
72s
platform
windows10_x64
resource
win10v20210408
submitted
03/08/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.exe
Size 691KB
Sample210803-tys17axg1e
SHA256 dbadb8a0f9e9085409ebaf01c9a2af057597b2bbf5b8ecdef2f1c5601cdfedc1
MD5 8479be1a6e5e17684648ba6a49a7d9f2
SHA1 b31ef7916ca258a323e02ae435181b9cde85aad1
SHA512 326c8f07e84083811366f4b37cdfb0018e71e41c98e9167bdc415216bc17dbd3f1fbbc84f101f6a8244cc919336a1204fd8c5a93d673f1a1868466405a437167
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://185.227.139.18/dsaicosaicasdi.php/XjjuWy0TVqjre
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 660 set thread context of 2104	660	triage_dropped_file.exe	74

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
660	triage_dropped_file.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2104	triage_dropped_file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	triage_dropped_file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2104	660	triage_dropped_file.exe	74
PID 660 wrote to memory of 2104	660	triage_dropped_file.exe	74
PID 660 wrote to memory of 2104	660	triage_dropped_file.exe	74
PID 660 wrote to memory of 2104	660	triage_dropped_file.exe	74

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:660
- C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
  "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-115-0x00000000001E0000-0x00000000001E2000-memory.dmp

Download

memory/2104-116-0x0000000000400000-0x00000000004A2000-memory.dmp