lokibot | 3a21143ed26feb405bc5eee9c81929b66d6ba41583b3b1d419a1d6f3edefed84

Analysis

max time kernel
114s
max time network
129s
platform
windows10_x64
resource
win10v20210408
submitted
12/08/2021, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40f1488d00e717a1d31f48477361ddee.exe
Size 611KB
Sample210812-ykvasbx3yn
SHA256 3a21143ed26feb405bc5eee9c81929b66d6ba41583b3b1d419a1d6f3edefed84
MD5 40f1488d00e717a1d31f48477361ddee
SHA1 63b3f7851830c85e2e23762e39010df6b5b2b39d
SHA512 90ded1e602f154e04dc044c1c0d3e3941a2263a252f72acfce7add21c5afd9f9fd2a644f848fe6072999a64642a393f96a0a416d67b2249e9f97eced290b86fb
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://manvim.co/fd14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3000	40f1488d00e717a1d31f48477361ddee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	40f1488d00e717a1d31f48477361ddee.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78
PID 636 wrote to memory of 3000	636	40f1488d00e717a1d31f48477361ddee.exe	78

C:\Users\Admin\AppData\Local\Temp\40f1488d00e717a1d31f48477361ddee.exe
"C:\Users\Admin\AppData\Local\Temp\40f1488d00e717a1d31f48477361ddee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\40f1488d00e717a1d31f48477361ddee.exe
  "C:\Users\Admin\AppData\Local\Temp\40f1488d00e717a1d31f48477361ddee.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-114-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/636-116-0x0000000005900000-0x0000000005901000-memory.dmp

Download

memory/636-117-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/636-118-0x00000000054A0000-0x00000000054A1000-memory.dmp

Download

memory/636-119-0x0000000005400000-0x00000000058FE000-memory.dmp

Download

memory/636-120-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/636-121-0x00000000055C0000-0x00000000055D1000-memory.dmp

Download

memory/636-122-0x0000000007980000-0x0000000007A07000-memory.dmp

Download

memory/636-123-0x000000000A050000-0x000000000A06C000-memory.dmp

Download

memory/3000-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3000-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads