lokibot | 2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3

Analysis

max time kernel
131s
max time network
121s
platform
windows7_x64
resource
win7v200430
submitted
09/07/2020, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe
Size

566KB
MD5

0702f9fe3c20240759c91bd61eb99abb
SHA1

b53968eda278e768d22b3d183762b2b4f04d5b09
SHA256

2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3
SHA512

3284216d43cc8b8212c030829447e6b9c36207a1150f02b554c16e9f66549ec13a3590c45de83f9bda15388503cfc09ebfefbdfa9b2f45ad1f773c101642b7e0

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

http://colorlux.ro/color/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1572	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1572	1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe	24
PID 1524 wrote to memory of 1572	1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe	24
PID 1524 wrote to memory of 1572	1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe	24
PID 1524 wrote to memory of 1572	1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe	24

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 1572	1524	2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe	24

C:\Users\Admin\AppData\Local\Temp\2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe
"C:\Users\Admin\AppData\Local\Temp\2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1524
- C:\Users\Admin\AppData\Local\Temp\2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe
  "C:\Users\Admin\AppData\Local\Temp\2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1572-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download