lokibot | ec3f2fdf975bb28883bbc08c93553f85ba0fbe6b19c184183a40ec4f3172b37f

Analysis

max time kernel
154s
max time network
173s
platform
windows7_x64
resource
win7v20210408
submitted
23/09/2021, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1d5bfbc58841648fa9a46768b6a408c.exe
Size 490KB
Sample210923-m6vbjshedr
SHA256 ec3f2fdf975bb28883bbc08c93553f85ba0fbe6b19c184183a40ec4f3172b37f
MD5 c1d5bfbc58841648fa9a46768b6a408c
SHA1 736d92b4e579364e0b7dc8da4904769c0d4cadf6
SHA512 9dddb5fc6fa3abee974ffb0e8255b2ab700785f03ebf492e93abd1992db9e7d2d2b916ba6be030400055aee18c43538557b553e45abc5666b9a6666b46b502f3
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://checkvim.com/fd7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1552	c1d5bfbc58841648fa9a46768b6a408c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	c1d5bfbc58841648fa9a46768b6a408c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27
PID 1608 wrote to memory of 1552	1608	c1d5bfbc58841648fa9a46768b6a408c.exe	27

C:\Users\Admin\AppData\Local\Temp\c1d5bfbc58841648fa9a46768b6a408c.exe
"C:\Users\Admin\AppData\Local\Temp\c1d5bfbc58841648fa9a46768b6a408c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\c1d5bfbc58841648fa9a46768b6a408c.exe
  "C:\Users\Admin\AppData\Local\Temp\c1d5bfbc58841648fa9a46768b6a408c.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1552-68-0x0000000074D91000-0x0000000074D93000-memory.dmp

Download

memory/1552-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1608-60-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/1608-62-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/1608-63-0x0000000000440000-0x000000000045D000-memory.dmp

Download

memory/1608-64-0x0000000004FC0000-0x0000000005019000-memory.dmp

Download

memory/1608-65-0x0000000000570000-0x0000000000599000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads