lokibot | 83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e

General

Target

83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
Size

348KB
MD5

4ab98a275e83315ab25f376c2500fc00
SHA1

bb3e84826ed9dade2311bdb0be60b0f639041ebb
SHA256

83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e
SHA512

970be824cdb2c76c80f63a23efc056cb13d252d98088a986fbd870909c2cae25d5488c82e3ca5c162a30f3f33256d7f0264414a37bf54052bf4c3a74be712010

Score

10^/10

trojan spyware stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://bayercornpany.com/php/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3940	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	67
PID 4012 wrote to memory of 3940	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	67
PID 4012 wrote to memory of 3940	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	67
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68
PID 4012 wrote to memory of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
Token: SeDebugPrivilege	3800	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 3800	4012	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe	68

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3800	83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
"C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:4012
- C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
  "{path}"
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:3800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3800-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing