lokibot | e1c2fa7e91fafcc9267986ba8a7a752434fba52bfabe07e8eefb2985ffa02827

Analysis

max time kernel
17s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
15/10/2020, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Advice_pdf.exe
Size 779KB
Sample201015-np3x8bb84a
SHA256 e1c2fa7e91fafcc9267986ba8a7a752434fba52bfabe07e8eefb2985ffa02827
MD5 7b1ac2f1bcdc1c532b34eead2ad6fb51
SHA1 532678c819a91b7fbf26fa5b2d5f38cdbee5fec1
SHA512 e34cd98be45e11afb0e95388bcfd442a929a1079792a5cdf9dd77dfab53f2fc28dc5447795779612efe3c349887a0d38f501b081795c8d18ab88674ec2ec2c91
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

http://195.69.140.147/.op/cr.php/kWBegfew6hSZA
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 424 set thread context of 3828	424	Payment Advice_pdf.exe	72

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
424	Payment Advice_pdf.exe
424	Payment Advice_pdf.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
424	Payment Advice_pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3828	Payment Advice_pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	Payment Advice_pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3828	424	Payment Advice_pdf.exe	72
PID 424 wrote to memory of 3828	424	Payment Advice_pdf.exe	72
PID 424 wrote to memory of 3828	424	Payment Advice_pdf.exe	72

C:\Users\Admin\AppData\Local\Temp\Payment Advice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:424
- C:\Users\Admin\AppData\Local\Temp\Payment Advice_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advice_pdf.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3828-1-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3828-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Download