lokibot | eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
Size

1.1MB
MD5

8b55653ee4d81ebca0bdc88e3b5fc942
SHA1

27f988ad6c42417936d25282f960c16daeebc00c
SHA256

eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7
SHA512

9bcca862c26fd0b41a0e4203fa6546fbda3c2a551d5115bb1fb204aee3644dc18c80d7eacdaa05815dd73ad5cd834ceddf0ab2f2ec233bdc7deb9f691c910b35
SSDEEP

24576:FSu1S82mBVrIiudqfO/9kfbRyWNaRVSVOJFXH7C:FSuU82mTVnRlxN1sJFX

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://sempersim.su/d3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe

description	pid	process	target process
PID 2192 set thread context of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe

description	pid	process	target process
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
PID 2192 wrote to memory of 2076	2192	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe	eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe

C:\Users\Admin\AppData\Local\Temp\eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
"C:\Users\Admin\AppData\Local\Temp\eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2192

C:\Users\Admin\AppData\Local\Temp\eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe
"C:\Users\Admin\AppData\Local\Temp\eb6d3ace662019bd56815df63efce445a2f9357ca21a187517e11d8a7dd022d7.exe"
2⤵
PID:2076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-12-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2076-5-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2076-8-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2076-17-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2076-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-10-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2076-7-0x00000000001A0000-0x0000000000242000-memory.dmp

Filesize
648KB

Download
memory/2192-1-0x0000000000040000-0x0000000000154000-memory.dmp

Filesize
1.1MB

Download
memory/2192-2-0x0000000000990000-0x00000000009DE000-memory.dmp

Filesize
312KB

Download
memory/2192-3-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2192-4-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2192-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2192-19-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download