lokibot | b61fbf292115599e5715c9a9fcbbb8b8f6cf630f3f98485f736a4ea70fdb53f1

Analysis

max time kernel
141s
max time network
148s
platform
windows10_x64
resource
win10v20210408
submitted
11/08/2021, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b326b2abdfd2dfee14c8b392a7c361d.exe
Size 794KB
Sample210811-vy86n67ex2
SHA256 b61fbf292115599e5715c9a9fcbbb8b8f6cf630f3f98485f736a4ea70fdb53f1
MD5 2b326b2abdfd2dfee14c8b392a7c361d
SHA1 868d0f6a4016e39e0a2396f14e1918964483cbd5
SHA512 3606a0efab406ef9a3dfc99e5d8e1bc9e8c2b3960f822934f8a1a1afcd9138b45fcd2d75cbf2572c1405052e8fa253845e651ca123bdf93534720ecdac3fda2a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://manvim.co/fd14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2876	2b326b2abdfd2dfee14c8b392a7c361d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	2b326b2abdfd2dfee14c8b392a7c361d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78
PID 1032 wrote to memory of 2876	1032	2b326b2abdfd2dfee14c8b392a7c361d.exe	78

C:\Users\Admin\AppData\Local\Temp\2b326b2abdfd2dfee14c8b392a7c361d.exe
"C:\Users\Admin\AppData\Local\Temp\2b326b2abdfd2dfee14c8b392a7c361d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\2b326b2abdfd2dfee14c8b392a7c361d.exe
  "C:\Users\Admin\AppData\Local\Temp\2b326b2abdfd2dfee14c8b392a7c361d.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-114-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1032-116-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/1032-117-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/1032-118-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/1032-119-0x0000000005080000-0x0000000005081000-memory.dmp

Download

memory/1032-120-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/1032-121-0x0000000005050000-0x000000000554E000-memory.dmp

Download

memory/1032-122-0x00000000054F0000-0x0000000005501000-memory.dmp

Download

memory/1032-123-0x0000000007730000-0x00000000077B8000-memory.dmp

Download

memory/1032-124-0x0000000009E10000-0x0000000009E2C000-memory.dmp

Download

memory/2876-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2876-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads