lokibot | 55b4be92fb1e6cf2d51b1598bea503929ef8f3166b19bffefd3320bf7eba4613

Analysis

max time kernel
98s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Darren-REFUD-PM.exe
Size 593KB
Sample201109-tx5v4tgvrs
SHA256 55b4be92fb1e6cf2d51b1598bea503929ef8f3166b19bffefd3320bf7eba4613
MD5 27451238cb526b4b2323295183f20044
SHA1 6c7244a35624a266127376ba994c9e02cf88ff1c
SHA512 6a1e8f12e280b35419cb9ce4662731e310883d6424b908d1242c109e7ffe6ed50e23cff071a69d424242ada9fc8c443751d98e38421c19a57defbae4e529b201
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://netease-163mail-com.tk/Darren/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4624 set thread context of 3340	4624	Darren-REFUD-PM.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78
PID 4624 wrote to memory of 3340	4624	Darren-REFUD-PM.exe	78

C:\Users\Admin\AppData\Local\Temp\Darren-REFUD-PM.exe
"C:\Users\Admin\AppData\Local\Temp\Darren-REFUD-PM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3340-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3340-2-0x0000000000400000-0x00000000004A2000-memory.dmp