lokibot | a8d1421f0d0d3babfd87e46e494a017c2627a20bf67d09b9a0dde3301e5511cf

Analysis

max time kernel
133s
max time network
133s
platform
windows10_x64
resource
win10
submitted
21/07/2020, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scan copy-1011211_pdf.exe
Size 666KB
Sample200721-wy2d57sccj
SHA256 a8d1421f0d0d3babfd87e46e494a017c2627a20bf67d09b9a0dde3301e5511cf
MD5 c1be609642320d4ebda2bf43a81fa809
SHA1 a606d376ce7330fb29c424e29adad961b16ff15b
SHA512 9f7f404cc43408c0ad6426d36c2452fb3ed7758f3d3c8bba3142defeceec05f28a0ee30927150d4898f9bc6da04f7a1291f197d95ae5fb189528dac80eab1964
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

http://brokenskull.ga/Colba1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
792	scan copy-1011211_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 2304	792	scan copy-1011211_pdf.exe	66

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	scan copy-1011211_pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2304	scan copy-1011211_pdf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
792	scan copy-1011211_pdf.exe
792	scan copy-1011211_pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2304	792	scan copy-1011211_pdf.exe	66
PID 792 wrote to memory of 2304	792	scan copy-1011211_pdf.exe	66
PID 792 wrote to memory of 2304	792	scan copy-1011211_pdf.exe	66

C:\Users\Admin\AppData\Local\Temp\scan copy-1011211_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\scan copy-1011211_pdf.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\scan copy-1011211_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\scan copy-1011211_pdf.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2304-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Download