lokibot | 7b8f2be19853cd2012b78f6fc89301cec921cf95b14a1aa69ebbc9bdb74e0d28

Analysis

max time kernel
104s
max time network
99s
platform
windows7_x64
resource
win7
submitted
17/07/2020, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BfzfoCzxZZUlbEg.exe
Size

682KB
MD5

c3e16f313fe5ffd21ffb677ea325721d
SHA1

e2547f4aa78c2a9e486bfdb12f7f203cdc9b41b0
SHA256

7b8f2be19853cd2012b78f6fc89301cec921cf95b14a1aa69ebbc9bdb74e0d28
SHA512

f4daa235b66c4a7a24804c7339f4f2fca35b589489e80dca07507d3f53da44d70693096da7f43cbfbf8458cc69e066f22efd8a86eb826e0ae70441171192a653

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

http://kanavagronomy.in/www.kanava/www123/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	BfzfoCzxZZUlbEg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
744	BfzfoCzxZZUlbEg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24
PID 1456 wrote to memory of 744	1456	BfzfoCzxZZUlbEg.exe	24

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 744	1456	BfzfoCzxZZUlbEg.exe	24

C:\Users\Admin\AppData\Local\Temp\BfzfoCzxZZUlbEg.exe
"C:\Users\Admin\AppData\Local\Temp\BfzfoCzxZZUlbEg.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1456
- C:\Users\Admin\AppData\Local\Temp\BfzfoCzxZZUlbEg.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/744-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download