lokibot | 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c

General

Target

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Size

332KB
MD5

dd03071b4a17130fcff4f9fb5b4fd533
SHA1

8a038e1ed5dcede0207e2267890a7dc9393d28ef
SHA256

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c
SHA512

6f94f89dda5c2e6bca2a61219cfa30631751c3dce73c375b9515fb2493ae5709be18ba23f0eb9b06cd6e2a30af50e2dbd6326c06305569bb64a75aca3f736c8e

Score

10^/10

trojan spyware stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://195.69.140.147/.op/cr.php/xbqxHCR0T1UiD

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

description	pid	process
Token: SeDebugPrivilege	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Token: SeDebugPrivilege	1104	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

pid	process
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

description	pid	process	target process
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

description	pid	process	target process
PID 1588 set thread context of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

pid process

1104 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

pid	process
1104	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
"C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1588

C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
"C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:1104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1104-4-0x00000000004139DE-mapping.dmp

Download
memory/1104-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1588-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads