lokibot | 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48

Analysis

max time kernel
131s
max time network
159s
platform
windows7_x64
resource
win7v20210408
submitted
13/09/2021, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gunzipped.exe
Size 305KB
Sample210913-fx5mlachf8
SHA256 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48
MD5 01fe8dea3052e01136d2e8bb7ab75fb9
SHA1 a68e6bd940df95fdafd67e6cbacff5d4995c616c
SHA512 1b90cf544811c1e23935ececcf4aaf794dafa47f8b023d2baf2d966ae93b54f6ab31950b213b1250df31acc28b972acdfebe072371edee09fb6bf609e2ce5f9b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://www.skscarsrjn.in/wp/zaq/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1280	1832	gunzipped.exe	26

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1832	gunzipped.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	gunzipped.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	gunzipped.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1280	1832	gunzipped.exe	26
PID 1832 wrote to memory of 1280	1832	gunzipped.exe	26
PID 1832 wrote to memory of 1280	1832	gunzipped.exe	26
PID 1832 wrote to memory of 1280	1832	gunzipped.exe	26
PID 1832 wrote to memory of 1280	1832	gunzipped.exe	26

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-61-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1280-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1832-62-0x0000000000380000-0x0000000000382000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads