lokibot | f6f185cf7c6591797f9df660caf11d8b0485d907ca46a8fdb9b1e31577f2be3e

Analysis

max time kernel
126s
max time network
128s
platform
windows10_x64
resource
win10v20210410
submitted
13/08/2021, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vslbnker inquiry.exe
Size 227KB
Sample210813-jk8dac67m2
SHA256 f6f185cf7c6591797f9df660caf11d8b0485d907ca46a8fdb9b1e31577f2be3e
MD5 8a8f6c7b9c8cee57d97b599be719bece
SHA1 6c1563076361e6af0775e39b1138983d3057b4e5
SHA512 2681c8ab605c1ab0fce1e0ea0e4172b3a560ee1bcc2278506852d7aa39ce45d857a1fc5864cfb9bf1c0daf9d312fb10efaa4720ced1bd8fddac79619dfbf3bbe
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://everydaywegrind.tk/Office3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3164 set thread context of 1468	3164	vslbnker inquiry.exe	76

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3164	vslbnker inquiry.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1468	vslbnker inquiry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	vslbnker inquiry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1468	3164	vslbnker inquiry.exe	76
PID 3164 wrote to memory of 1468	3164	vslbnker inquiry.exe	76
PID 3164 wrote to memory of 1468	3164	vslbnker inquiry.exe	76
PID 3164 wrote to memory of 1468	3164	vslbnker inquiry.exe	76

C:\Users\Admin\AppData\Local\Temp\vslbnker inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\vslbnker inquiry.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\vslbnker inquiry.exe
  "C:\Users\Admin\AppData\Local\Temp\vslbnker inquiry.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-116-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3164-115-0x0000000000610000-0x0000000000612000-memory.dmp