lokibot | 6c0612e71239972d92121249145948eec8ccfab90e1e47d0337fabccaaa5ade2

General

Target
PO#499039.exe
Size 1.7MB
Sample201028-mvb8wfk3c6
SHA256 6c0612e71239972d92121249145948eec8ccfab90e1e47d0337fabccaaa5ade2
MD5 e3965bf545237286d3c252bd368f4488
SHA1 34109656ecf5616aac87bd2da4e733de44356257
SHA512 2e8b47702803414a510c8dd26c549c87f70d0ecf35c3c326dfa0ca88b1f846ec0a6fcd5fe731c4dd93d7be503c19a80283a13531f0166ffc5ad4206704b08a1f
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://192.236.147.197/bg/dope/ltd.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 2584	3892	PO#499039.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe
3892	PO#499039.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2584	PO#499039.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	PO#499039.exe
Token: SeDebugPrivilege	2584	PO#499039.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2308	3892	PO#499039.exe	77
PID 3892 wrote to memory of 2308	3892	PO#499039.exe	77
PID 3892 wrote to memory of 2308	3892	PO#499039.exe	77
PID 3892 wrote to memory of 2336	3892	PO#499039.exe	78
PID 3892 wrote to memory of 2336	3892	PO#499039.exe	78
PID 3892 wrote to memory of 2336	3892	PO#499039.exe	78
PID 3892 wrote to memory of 2396	3892	PO#499039.exe	79
PID 3892 wrote to memory of 2396	3892	PO#499039.exe	79
PID 3892 wrote to memory of 2396	3892	PO#499039.exe	79
PID 3892 wrote to memory of 2400	3892	PO#499039.exe	80
PID 3892 wrote to memory of 2400	3892	PO#499039.exe	80
PID 3892 wrote to memory of 2400	3892	PO#499039.exe	80
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81
PID 3892 wrote to memory of 2584	3892	PO#499039.exe	81

C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
"C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
  2⤵
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
  2⤵
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\PO#499039.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#499039.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2584-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3892-0-0x00000000737D0000-0x0000000073EBE000-memory.dmp

Download

memory/3892-1-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/3892-3-0x0000000004C10000-0x0000000004C55000-memory.dmp

Download

memory/3892-4-0x0000000002410000-0x0000000002426000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads