lokibot | 8f32f4ab6f296834aada023487375844444faa005da968ed2f45302c9dc01664

Analysis

max time kernel
129s
max time network
139s
platform
windows10_x64
resource
win10v20210408
submitted
01/09/2021, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 5800209777.exe
Size 204KB
Sample210901-abpht78jb6
SHA256 8f32f4ab6f296834aada023487375844444faa005da968ed2f45302c9dc01664
MD5 19b000d55b249d12c7a0ade4b96865fd
SHA1 d386ceeb1471f499cefc95523ee0d0ff2537689f
SHA512 4273ef702a96c3367d449c9ea6d928a217165bfeac7366df8ae7804cab3dff99e0634fa1292dd4f38de1e305bcdb583b5a5d72f5fb3afce4bba56e78f6808ef9
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://brknoutofway.gq/Office4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 544	656	PO 5800209777.exe	75

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
656	PO 5800209777.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
544	PO 5800209777.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	PO 5800209777.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 544	656	PO 5800209777.exe	75
PID 656 wrote to memory of 544	656	PO 5800209777.exe	75
PID 656 wrote to memory of 544	656	PO 5800209777.exe	75
PID 656 wrote to memory of 544	656	PO 5800209777.exe	75

C:\Users\Admin\AppData\Local\Temp\PO 5800209777.exe
"C:\Users\Admin\AppData\Local\Temp\PO 5800209777.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\PO 5800209777.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 5800209777.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-116-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/656-115-0x0000000003120000-0x0000000003122000-memory.dmp