lokibot | 846d2bcdab1a1342fdfcf0636d1ead7b9411d1212331ca95fb568f56ecb7842d

Analysis

max time kernel
98s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order sheet_Product Prices list.exe
Size 563KB
Sample201109-m172ay7at2
SHA256 846d2bcdab1a1342fdfcf0636d1ead7b9411d1212331ca95fb568f56ecb7842d
MD5 fbd9913faa9ad3f07f80d56f000cfbfd
SHA1 188708df22f9faa21018ce02e1df398230aa5418
SHA512 6915e39804d1b5801479abb019aa04ba38be5498cec8cecfc8fbda3b8f59c56ae003b389615bc6373d132b1849bed8718a049b50d5f495d5e0184a0e9e8078f5
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://anatoli1.ga/Pablo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 3144	3988	Order sheet_Product Prices list.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79
PID 3988 wrote to memory of 3144	3988	Order sheet_Product Prices list.exe	79

C:\Users\Admin\AppData\Local\Temp\Order sheet_Product Prices list.exe
"C:\Users\Admin\AppData\Local\Temp\Order sheet_Product Prices list.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3144-2-0x0000000000400000-0x00000000004A2000-memory.dmp