5ace46908b446b856c8761b2935e8d4cde832b53049facf5a9ffe3795c8af078

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 15:27

Target

Lokibot.exe
Size

592KB
MD5

3c7d7791f1deba22d2c94e6d07d730cb
SHA1

fee1ab09784f3ba1570dbe22f37330202710f303
SHA256

5b08466cd86a0361398d34b9dfb5acd06834b59d4fc44d15b087be88596f63ae
SHA512

852f3838c4511a062c2b201c89d568b2cf8c7f7f89790f1f60dd71c86c98cae06f27641db66113f0ed43ff74fbe4041b471d768cd2b99b409f4d851e93155e02
SSDEEP

12288:mSkOvbnR8ey/ZhgLXDjzFqIGiYs3gY/FqYUQOpkVDASsgRC0d:Yv2XGiBgmFaOq

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Lokibot.exe

pid process

1344 Lokibot.exe
1344 Lokibot.exe
1344 Lokibot.exe
1344 Lokibot.exe
1344 Lokibot.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Lokibot.exe

description pid process

Token: SeDebugPrivilege 1344 Lokibot.exe

description	pid	process
Token: SeDebugPrivilege	1344	Lokibot.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Lokibot.exe

description	pid	process	target process
PID 1344 wrote to memory of 588	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 588	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 588	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 588	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 1384	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 1384	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 1384	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 1384	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 332	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 332	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 332	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 332	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 688	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 688	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 688	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 688	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 792	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 792	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 792	1344	Lokibot.exe	Lokibot.exe
PID 1344 wrote to memory of 792	1344	Lokibot.exe	Lokibot.exe

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:588
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:792

memory/1344-54-0x0000000000380000-0x0000000000418000-memory.dmp

Filesize
608KB

Download
memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1344-57-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1344-58-0x00000000020A0000-0x00000000020FA000-memory.dmp

Filesize
360KB

Download
memory/1344-59-0x0000000000740000-0x0000000000762000-memory.dmp

Filesize
136KB

Download