lokibot | 02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737

General

Target

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
Size

1.0MB
MD5

d684fa1626b63d9a17c8818a63a23975
SHA1

58b118874ca88dc269d7345fa84fb33e3e42aab7
SHA256

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737
SHA512

5f3a889a73b8ace63b9d48518871a0effb65d3581d4fce0bea28576ffdccef6a5d4f8d974f87bf6047ea514748ed88f52572eea8053b4bf4e17e373725ade20b

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://worldpackmx.com/fretyuil/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

description	pid	process	target process
PID 1628 set thread context of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

pid process

3392 02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

description pid process

Token: SeDebugPrivilege 3392 02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

pid	process
3392	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

description	pid	process
Token: SeDebugPrivilege	3392	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

description	pid	process	target process
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
PID 1628 wrote to memory of 3392	1628	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe	02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe

C:\Users\Admin\AppData\Local\Temp\02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
"C:\Users\Admin\AppData\Local\Temp\02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe
"C:\Users\Admin\AppData\Local\Temp\02944dc72a15e92ec94c453c74c9564cb59ac7717dffcb25fa854a2e587fb737.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3392-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3392-4-0x00000000004139DE-mapping.dmp

Download

Analysis

Sharing