Analysis
- max time kernel
5s - max time network
3s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
10/07/2024, 04:28
General
- Target Lokibot.exe
- Size 300KB
- Sample240710-e343kswgqq
- SHA256 a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp
memory/4760-1-0x0000000000E50000-0x0000000000EA2000-memory.dmp
memory/4760-2-0x0000000001540000-0x0000000001554000-memory.dmp
memory/4760-3-0x0000000005F80000-0x0000000006524000-memory.dmp
memory/4760-4-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/4760-5-0x0000000003560000-0x0000000003568000-memory.dmp
memory/4760-6-0x0000000006650000-0x00000000066E2000-memory.dmp
memory/4760-7-0x0000000006640000-0x0000000006648000-memory.dmp
memory/4760-8-0x00000000068C0000-0x0000000006904000-memory.dmp
memory/4760-9-0x0000000074F80000-0x0000000075730000-memory.dmp