lokibot | b236304dad4fcf402b8dddc467038cbaf623284155ccc5671c972f57d238e088

Analysis

max time kernel
123s
max time network
139s
platform
windows10_x64
resource
win10v20210410
submitted
05/08/2021, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.exe
Size 327KB
Sample210805-4eh2d3m5hs
SHA256 b236304dad4fcf402b8dddc467038cbaf623284155ccc5671c972f57d238e088
MD5 d07fd206bfadd24bc7e4939c7b24e098
SHA1 e829b677f7231c1cf5d544deb6da1a2b2a5bc5ca
SHA512 830ce2014ebbab8b85a6fa2ec459518b13ea4bb151fbefedb39aef1ff3df2e6d6def4a5ffc84213a4e4e17cb1f1cdc1869d95733a84d7bd471a0b555255f512d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://brokenethicalgod.ml/BN11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3680 set thread context of 3400	3680	triage_dropped_file.exe	75

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3680	triage_dropped_file.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3400	triage_dropped_file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	triage_dropped_file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3400	3680	triage_dropped_file.exe	75
PID 3680 wrote to memory of 3400	3680	triage_dropped_file.exe	75
PID 3680 wrote to memory of 3400	3680	triage_dropped_file.exe	75
PID 3680 wrote to memory of 3400	3680	triage_dropped_file.exe	75

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
  "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-116-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3680-115-0x00000000001E0000-0x00000000001E2000-memory.dmp