lokibot | e6af8c20aa307a53eb603f3e0d8858cff02f49495c9b51ce410cc841581283d4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/TenrecSaggar.dll
Size

43KB
MD5

edb845779d91dcc37810eec0f029dfd3
SHA1

8ed5905bf015d0f7508b2af8b6be79a368aceada
SHA256

785275c1afb2a166f159c391a21afe5d82c30cc479a7837c28abb89adff67b87
SHA512

829b227037b4e3be5811b396ebaf7dbffb1ada24d955025d96f81a61d774c400b6c3997133f72cb1a601a7de60033baef344333bc8cd8749628eac4d206f2016
SSDEEP

768:JT0LUpldyjKuOexoIhIOGnTEDVBP3vydFd1sbUKV:JSCyhSgY4BidFiV

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://remzclot.ga/etc/main/l09/harl/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2660	rundll32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2660	rundll32.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2460 wrote to memory of 2660	2460	rundll32.exe	28
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29
PID 2660 wrote to memory of 2664	2660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2660-0-0x0000000074E90000-0x0000000074EE8000-memory.dmp

Filesize
352KB

Download
memory/2660-2-0x0000000075A40000-0x0000000075A75000-memory.dmp

Filesize
212KB

Download
memory/2660-6-0x0000000074E90000-0x0000000074EE8000-memory.dmp

Filesize
352KB

Download
memory/2664-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-5-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download