lokibot | e29aab6bf4f627b3068a69e6bb8cbe4c98d7e5994bf7ff5d53a4a2e7e98ccc20

Analysis

max time kernel
136s
max time network
129s
platform
windows10_x64
resource
win10v200430
submitted
20/07/2020, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.exe
Size 674KB
Sample200720-ex3nw5t35a
SHA256 e29aab6bf4f627b3068a69e6bb8cbe4c98d7e5994bf7ff5d53a4a2e7e98ccc20
MD5 8f4c8d16eb563ed0f2ea2602bb31cf2c
SHA1 215d12bc98129cfed19297a9c766ed43a720a27b
SHA512 f25bd12f71f66fc0bf1481bb60d5cbdbd2dbb946bafc8662ce75ca06e40d8ea4fbfc506e98843cab3d1143bce6cb843fb95bd8788deca002a680257589fd7a3c
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

http://mecharnise.ir/ea5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1276	SOA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
664	SOA.exe
664	SOA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 1276	664	SOA.exe	68
PID 664 wrote to memory of 1276	664	SOA.exe	68
PID 664 wrote to memory of 1276	664	SOA.exe	68

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
664	SOA.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 1276	664	SOA.exe	68

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	SOA.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:664
- C:\Users\Admin\AppData\Local\Temp\SOA.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1276-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download