lokibot | 2d76841d2096a7c76ba0e1e7905d4231a31caa083a2f2bfc68d5911755ee6043

General

Target
66426dc24f37ef4e687af00701fdbe3f.exe
Size 504KB
Sample201218-cgdwa2z15j
SHA256 2d76841d2096a7c76ba0e1e7905d4231a31caa083a2f2bfc68d5911755ee6043
MD5 66426dc24f37ef4e687af00701fdbe3f
SHA1 795dff01dc8fdb634684b8c861785aedcb474714
SHA512 930faaa68ec50bf605bc4f79cfd173649b80c789aaf259969a4b6bb896c36ee752d33d28a752c8846e2523216e5e5202bf90c2b9bd2d5802cad29fa4ebbe37c2
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://begadi.ga/chud/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 576 set thread context of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
576	66426dc24f37ef4e687af00701fdbe3f.exe
576	66426dc24f37ef4e687af00701fdbe3f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
196	66426dc24f37ef4e687af00701fdbe3f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	66426dc24f37ef4e687af00701fdbe3f.exe
Token: SeDebugPrivilege	196	66426dc24f37ef4e687af00701fdbe3f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 212	576	66426dc24f37ef4e687af00701fdbe3f.exe	78
PID 576 wrote to memory of 212	576	66426dc24f37ef4e687af00701fdbe3f.exe	78
PID 576 wrote to memory of 212	576	66426dc24f37ef4e687af00701fdbe3f.exe	78
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79
PID 576 wrote to memory of 196	576	66426dc24f37ef4e687af00701fdbe3f.exe	79

C:\Users\Admin\AppData\Local\Temp\66426dc24f37ef4e687af00701fdbe3f.exe
"C:\Users\Admin\AppData\Local\Temp\66426dc24f37ef4e687af00701fdbe3f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\66426dc24f37ef4e687af00701fdbe3f.exe
  "{path}"
  2⤵
  PID:212
- C:\Users\Admin\AppData\Local\Temp\66426dc24f37ef4e687af00701fdbe3f.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/196-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/196-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/576-2-0x0000000073560000-0x0000000073C4E000-memory.dmp

Download

memory/576-3-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/576-5-0x00000000075F0000-0x00000000075F1000-memory.dmp

Download

memory/576-6-0x00000000070F0000-0x00000000070F1000-memory.dmp

Download

memory/576-7-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/576-8-0x0000000007280000-0x0000000007284000-memory.dmp

Download

memory/576-9-0x0000000008CF0000-0x0000000008D47000-memory.dmp

Download

memory/576-10-0x0000000009370000-0x0000000009371000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads