lokibot | e9efdd49a48ce3a9c8f4bf0bdb38a76b5cef412518e783247c07d11a4e3dabf5 | Triage

Analysis

max time kernel
126s
max time network
133s
platform
windows10_x64
resource
win10v20210408
submitted
10-08-2021 11:05

Sharing

Report Analysis Logs

General

Target

68876b3356b1be74584c39e154e5abcb.exe
Size

104KB
MD5

68876b3356b1be74584c39e154e5abcb
SHA1

7ce3fb557d68864c7c7457c3f088914015358fcd
SHA256

e9efdd49a48ce3a9c8f4bf0bdb38a76b5cef412518e783247c07d11a4e3dabf5
SHA512

26d32a68abebf809d1c4d27b918f78d86a1c5a98edc9b4edbe42b7341628f5d632ffcbbd16fe8492b2056cf2775057582810dcf547437825a94fb989e5b9b1a8

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious behavior: RenamesItself 1 IoCs

Processes:

68876b3356b1be74584c39e154e5abcb.exe

pid	Process
996	68876b3356b1be74584c39e154e5abcb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

68876b3356b1be74584c39e154e5abcb.exe

description	pid	Process
Token: SeDebugPrivilege	996	68876b3356b1be74584c39e154e5abcb.exe

C:\Users\Admin\AppData\Local\Temp\68876b3356b1be74584c39e154e5abcb.exe
"C:\Users\Admin\AppData\Local\Temp\68876b3356b1be74584c39e154e5abcb.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads