lokibot | ecacb6fc355d68e8e3899e35796b85b02d4436db3e0e1db9a00a5922c5323f57

Analysis

max time kernel
126s
max time network
129s
platform
windows10_x64
resource
win10
submitted
06/10/2020, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Account Statement.exe
Size 688KB
Sample201006-3a5lp4mnd2
SHA256 ecacb6fc355d68e8e3899e35796b85b02d4436db3e0e1db9a00a5922c5323f57
MD5 ef8cae9b4ffd6226db5a0a68863a768e
SHA1 9e2d9710a6f9996b3433fdaff99df12a9968588c
SHA512 dd576aa94ce70a63e0187bd4e8a445b48585f64f97d0ca736bd4c57f55e18e351adc78a1f7c732560c81c1af3d6270d9ef7a6f7c99dd12b3588349dd552f270f
MD5 SHA1 SHA512

Score

10^/10

trojan spyware stealer lokibot

Malware Config

Extracted

Family

lokibot

http://alifmedical.shop/al/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3040	3828	Account Statement.exe	73

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	Account Statement.exe
3828	Account Statement.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3828	Account Statement.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3040	Account Statement.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	Account Statement.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3040	3828	Account Statement.exe	73
PID 3828 wrote to memory of 3040	3828	Account Statement.exe	73
PID 3828 wrote to memory of 3040	3828	Account Statement.exe	73

C:\Users\Admin\AppData\Local\Temp\Account Statement.exe
"C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\Account Statement.exe
  "C:\Users\Admin\AppData\Local\Temp\Account Statement.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-1-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3040-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3828-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Download