lokibot | 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48

Analysis

max time kernel
126s
max time network
149s
platform
windows10_x64
resource
win10-en
submitted
13/09/2021, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gunzipped.exe
Size 305KB
Sample210913-fx5mlachf8
SHA256 03cb95fdd2bb94ff411d1737206768638ad47e1a0a52a31f8b697dc6a827fc48
MD5 01fe8dea3052e01136d2e8bb7ab75fb9
SHA1 a68e6bd940df95fdafd67e6cbacff5d4995c616c
SHA512 1b90cf544811c1e23935ececcf4aaf794dafa47f8b023d2baf2d966ae93b54f6ab31950b213b1250df31acc28b972acdfebe072371edee09fb6bf609e2ce5f9b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://www.skscarsrjn.in/wp/zaq/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 3716	3972	gunzipped.exe	69

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3972	gunzipped.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3716	gunzipped.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	gunzipped.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3716	3972	gunzipped.exe	69
PID 3972 wrote to memory of 3716	3972	gunzipped.exe	69
PID 3972 wrote to memory of 3716	3972	gunzipped.exe	69
PID 3972 wrote to memory of 3716	3972	gunzipped.exe	69

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-117-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3972-116-0x00000000001D0000-0x00000000001F3000-memory.dmp