lokibot | 5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd

General

Target
5f81feea551373cd4f84f42112639e2f.exe
Size 434KB
Sample201209-akcjbaevaa
SHA256 5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd
MD5 5f81feea551373cd4f84f42112639e2f
SHA1 022e0771c6a113e7db22c2b767fd8c7463fbcbae
SHA512 5fca5bf76e9b05741ab558c2617b7333b2b07f6f1f8eddb9fb9362c8586d00cc21fc319f8259811936d7a7f1e3f9458de29457c3c99c028885116e6aba04d6db
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://forrastfoods.com/candy/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 476 set thread context of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
476	5f81feea551373cd4f84f42112639e2f.exe
476	5f81feea551373cd4f84f42112639e2f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
392	5f81feea551373cd4f84f42112639e2f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	5f81feea551373cd4f84f42112639e2f.exe
Token: SeDebugPrivilege	392	5f81feea551373cd4f84f42112639e2f.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1692	476	5f81feea551373cd4f84f42112639e2f.exe	29
PID 476 wrote to memory of 1692	476	5f81feea551373cd4f84f42112639e2f.exe	29
PID 476 wrote to memory of 1692	476	5f81feea551373cd4f84f42112639e2f.exe	29
PID 476 wrote to memory of 1692	476	5f81feea551373cd4f84f42112639e2f.exe	29
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30
PID 476 wrote to memory of 392	476	5f81feea551373cd4f84f42112639e2f.exe	30

C:\Users\Admin\AppData\Local\Temp\5f81feea551373cd4f84f42112639e2f.exe
"C:\Users\Admin\AppData\Local\Temp\5f81feea551373cd4f84f42112639e2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\5f81feea551373cd4f84f42112639e2f.exe
  "{path}"
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\5f81feea551373cd4f84f42112639e2f.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/392-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/476-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Download

memory/476-3-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/476-5-0x00000000002D0000-0x00000000002DE000-memory.dmp

Download

memory/476-6-0x0000000007D20000-0x0000000007D81000-memory.dmp

Download

memory/808-10-0x000007FEF74B0000-0x000007FEF772A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads