lokibot | 5e65904a7ea34c0059d10a8048eee92faebec842348fa3c52b8ed4641cbc9b7e

Analysis

max time kernel
119s
max time network
120s
platform
windows10_x64
resource
win10-en-20210920
submitted
07/10/2021, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f493a60bcc8e5336a439557b2b2ff58b.exe
Size 324KB
Sample211007-ymj71sdbap
SHA256 5e65904a7ea34c0059d10a8048eee92faebec842348fa3c52b8ed4641cbc9b7e
MD5 f493a60bcc8e5336a439557b2b2ff58b
SHA1 1160cd7ab28253e09d6f2b07481b6884e8f93672
SHA512 3b87841568f7f39afe82b27056bb9fade895d1d7251504702dd7c4b18c930c2b6decfb86818d4b03b4e993133a5efb06151075e49008adcf5b2db32a07664864
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://136.243.159.53/~element/page.php?id=491
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3580 set thread context of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	RegSvcs.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70
PID 3580 wrote to memory of 2264	3580	f493a60bcc8e5336a439557b2b2ff58b.exe	70

C:\Users\Admin\AppData\Local\Temp\f493a60bcc8e5336a439557b2b2ff58b.exe
"C:\Users\Admin\AppData\Local\Temp\f493a60bcc8e5336a439557b2b2ff58b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2264-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3580-115-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/3580-117-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/3580-118-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/3580-119-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/3580-120-0x0000000006E80000-0x0000000006E81000-memory.dmp

Download

memory/3580-121-0x0000000004930000-0x0000000004E2E000-memory.dmp

Download

memory/3580-122-0x0000000004D20000-0x0000000004D2A000-memory.dmp

Download

memory/3580-123-0x0000000006730000-0x000000000676D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads