lokibot | 39ee5de517139fe061acafd45d09fcfc38d732e9abe8d14119f2b05b6ea26111

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe
Size

185KB
MD5

8f746e8f11d34dfb6bca0eccc147df2d
SHA1

2f2b6b1800505f3d357e0aa49c4e9cc054ae161a
SHA256

39ee5de517139fe061acafd45d09fcfc38d732e9abe8d14119f2b05b6ea26111
SHA512

4da6d434dc80711a4e72ebcf529836ff797468414772af38cb35491ec8cf3e13138cfe796a73037569eda9f1770a2c7ddae544a6c29bc6778815239c4021b9f2
SSDEEP

3072:28n9R7/ASx0R/KaiI3otOwkamJsJGSP551cLc6LCZWUjh4XQqx/L79Is4Q2szaKT:28n3r/u/WIyOwka4Cxc5mozDxIs4QPz9

Score

10^/10

lokibot agilenet spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://confirmationduck.ooo/sql/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/4416-6-0x0000000005490000-0x00000000054A4000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4416 set thread context of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91
PID 4416 wrote to memory of 3196	4416	8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118.exe"
  2⤵
  PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-10-0x0000000000610000-0x00000000006B2000-memory.dmp

Filesize
648KB

Download
memory/4416-0-0x000000007501E000-0x000000007501F000-memory.dmp

Filesize
4KB

Download
memory/4416-1-0x0000000000810000-0x0000000000844000-memory.dmp

Filesize
208KB

Download
memory/4416-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/4416-3-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/4416-4-0x00000000052B0000-0x00000000052BA000-memory.dmp

Filesize
40KB

Download
memory/4416-5-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-6-0x0000000005490000-0x00000000054A4000-memory.dmp

Filesize
80KB

Download
memory/4416-7-0x0000000005850000-0x00000000058EC000-memory.dmp

Filesize
624KB

Download
memory/4416-12-0x0000000075010000-0x00000000757C0000-memory.dmp

Filesize
7.7MB

Download