lokibot | 310cb005c21c57556ce727e947b156d61715adea6d73c342902c8620f287643d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

staff records.exe
Size

971KB
MD5

b511b0274759a20e0e3ef09e8a8e7717
SHA1

60ef9a156c1e4845367a4ef2d9363ff1f0ae2636
SHA256

310cb005c21c57556ce727e947b156d61715adea6d73c342902c8620f287643d
SHA512

849350c66ea07b808d2d6c36f4a9ff05009d8601e6d55e92e3c289211ca14a0902d815ba844977d234ddd446ec719498f05921b106aa202061176ac616fdb61b
SSDEEP

12288:ytb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgacTnH/ujAWYaEN6A:ytb20pkaCqT5TBWgNQ7asnH/+YjN6A

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://giampaolidolciaria.cfd/DV2/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 3024	1640	staff records.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1640	staff records.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1640	staff records.exe
1640	staff records.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1640	staff records.exe
1640	staff records.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3024	1640	staff records.exe	28
PID 1640 wrote to memory of 3024	1640	staff records.exe	28
PID 1640 wrote to memory of 3024	1640	staff records.exe	28
PID 1640 wrote to memory of 3024	1640	staff records.exe	28
PID 1640 wrote to memory of 3024	1640	staff records.exe	28

C:\Users\Admin\AppData\Local\Temp\staff records.exe
"C:\Users\Admin\AppData\Local\Temp\staff records.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\staff records.exe"
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-10-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/3024-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download