lokibot | 345f95df7ce5161df077e1c444e28874e380449f2b39e54800c7a2bc4e5e3529

Analysis

max time kernel
117s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
17/08/2021, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87dfc60c54a1bd161cd5583ae0ebfc7c.exe
Size 1.1MB
Sample210817-qv2t23dr7a
SHA256 345f95df7ce5161df077e1c444e28874e380449f2b39e54800c7a2bc4e5e3529
MD5 87dfc60c54a1bd161cd5583ae0ebfc7c
SHA1 7dfa8ca16ad1bc23b2a9e547b7828ed6d913e34b
SHA512 d25896b8b38ee76628b79b9d58bea8b997de8814c4c67feec1f00eb677b4f54c7e109abdc14e189749a7ffa1b2e5fd2e053c066db558a6b742d82bb7a3d75358
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://manvim.co/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1336	87dfc60c54a1bd161cd5583ae0ebfc7c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	87dfc60c54a1bd161cd5583ae0ebfc7c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78
PID 800 wrote to memory of 1336	800	87dfc60c54a1bd161cd5583ae0ebfc7c.exe	78

C:\Users\Admin\AppData\Local\Temp\87dfc60c54a1bd161cd5583ae0ebfc7c.exe
"C:\Users\Admin\AppData\Local\Temp\87dfc60c54a1bd161cd5583ae0ebfc7c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\87dfc60c54a1bd161cd5583ae0ebfc7c.exe
  "C:\Users\Admin\AppData\Local\Temp\87dfc60c54a1bd161cd5583ae0ebfc7c.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-114-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/800-116-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/800-117-0x0000000005630000-0x0000000005631000-memory.dmp

Download

memory/800-118-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/800-119-0x0000000005070000-0x0000000005071000-memory.dmp

Download

memory/800-120-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/800-121-0x0000000005130000-0x000000000562E000-memory.dmp

Download

memory/800-122-0x00000000087D0000-0x00000000087E1000-memory.dmp

Download

memory/800-123-0x00000000088B0000-0x0000000008934000-memory.dmp

Download

memory/800-124-0x000000000B080000-0x000000000B09B000-memory.dmp

Download

memory/1336-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1336-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads