lokibot | 3493adb86f0da3a09e5eea6a97f8490a7718158742d29c4f14aca8ce30c4aeaf

Analysis

max time kernel
64s
max time network
92s
platform
windows10_x64
resource
win10
submitted
24/06/2020, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gunzipped.exe
Size 241KB
Sample200624-avanmpx736
SHA256 3493adb86f0da3a09e5eea6a97f8490a7718158742d29c4f14aca8ce30c4aeaf
MD5 2ae92b3fc0cd3dc9c4df703a4a15e15a
SHA1 8cd16e0ed4b9e40b2808f631d9c9a230046c6edd
SHA512 311d4f1eb38308872352b3ba68fe099000638a8ed8b653a7f5104851bf116d339f82e76e1d4e7701f45e4b29e5e3c0dda0ce2909d848dc724b6eb03c784b4bad
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

zoldpasszus.hu/bb/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67
PID 3104 wrote to memory of 4072	3104	gunzipped.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 4072	3104	gunzipped.exe	67

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	gunzipped.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4072	gunzipped.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3104
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4072-2-0x0000000000400000-0x00000000004A2000-memory.dmp