lokibot | 57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad

General

Target

whitty.exe
Size

154KB
MD5

2e107acd5b8ed0e66c5fee0513ace7c1
SHA1

94fc8fd5e841283747390f80583392dc85f845bb
SHA256

57e052aa747095c82cdc7e459d734e98bf1dde6853d94f2b1179f47b30ddcdad
SHA512

93d27f39f10a4c5c27adba3e1bd06a2189d36d2bf8e3250585733ec80d7d783daa09e5c9ea2264a4458adc972b4ef702736058b45e9e38ac064c341c535bed26

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://79.124.8.8/plesk-site-preview/akinsab.ru/http/79.124.8.8/whitty/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

whitty.exewhitty.exe

description pid process

Token: SeDebugPrivilege 1460 whitty.exe
Token: SeDebugPrivilege 292 whitty.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

whitty.exe

pid process

1460 whitty.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

whitty.exe

description pid process target process

PID 1460 set thread context of 292 1460 whitty.exe whitty.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

whitty.exe

pid process

292 whitty.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

description	pid	process
Token: SeDebugPrivilege	1460	whitty.exe
Token: SeDebugPrivilege	292	whitty.exe

pid	process
1460	whitty.exe

description	pid	process	target process
PID 1460 set thread context of 292	1460	whitty.exe	whitty.exe

pid	process
292	whitty.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

whitty.exe

description	pid	process	target process
PID 1460 wrote to memory of 788	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 788	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 788	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 788	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe
PID 1460 wrote to memory of 292	1460	whitty.exe	whitty.exe

C:\Users\Admin\AppData\Local\Temp\whitty.exe
"C:\Users\Admin\AppData\Local\Temp\whitty.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\whitty.exe
"{path}"
2⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\whitty.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/292-3-0x00000000004139DE-mapping.dmp

Download
memory/292-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1460-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download

Analysis

Sharing