lokibot | 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c

General

Target

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Size

332KB
MD5

dd03071b4a17130fcff4f9fb5b4fd533
SHA1

8a038e1ed5dcede0207e2267890a7dc9393d28ef
SHA256

404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c
SHA512

6f94f89dda5c2e6bca2a61219cfa30631751c3dce73c375b9515fb2493ae5709be18ba23f0eb9b06cd6e2a30af50e2dbd6326c06305569bb64a75aca3f736c8e

Score

10^/10

trojan spyware stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://195.69.140.147/.op/cr.php/xbqxHCR0T1UiD

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Token: SeDebugPrivilege	1104	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24
PID 1588 wrote to memory of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1104	1588	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe	24

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1104	404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
"C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1588
- C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
  "C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1104-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing