lokibot | 3caa2ce46c3c7fd2fd8a56371a56f0c6dd355fdeaa139eb7cdf3bf7a1360e6f5

Analysis

max time kernel
51s
max time network
80s
platform
windows7_x64
resource
win7v20210408
submitted
13/08/2021, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe
Size 609KB
Sample210813-t8d36qplts
SHA256 3caa2ce46c3c7fd2fd8a56371a56f0c6dd355fdeaa139eb7cdf3bf7a1360e6f5
MD5 fb19434fc1328583cf86a06442960fd4
SHA1 da744df0f0d4b669c36996f0cd135c6c77153ab1
SHA512 54fe2c5338f50b2dc17e60bf4e4e821db4c0706175c9581eadc51871284d630900ecaad2736f671e6ce19b4ffe48ad2b5e3b06ee5086c8fb30fc989d0edce053
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://155.254.33.183/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1368	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29
PID 1664 wrote to memory of 1368	1664	3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe	29

C:\Users\Admin\AppData\Local\Temp\3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe
"C:\Users\Admin\AppData\Local\Temp\3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe
  "C:\Users\Admin\AppData\Local\Temp\3CAA2CE46C3C7FD2FD8A56371A56F0C6DD355FDEAA139.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1368-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1664-60-0x0000000075C71000-0x0000000075C73000-memory.dmp

Download

memory/1664-61-0x0000000000270000-0x0000000000271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads