lokibot | 9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f

General

Target

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
Size

985KB
MD5

dd56737c942385f2ab60a3e80a175ed2
SHA1

1a990bf3c300b119de7b9f6f16b246c6a8848855
SHA256

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f
SHA512

e1a5c778629068c23af7884db21f0e96a16ddb52f24934bf1b7a945632db902ad41f4bfb7749d8ed6280c0bc1e1a4fa51598d6f53f7988c0bf65a7b920dc1a1b

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://azzmtool.com/chief/offor/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

description	pid	process	target process
PID 1156 set thread context of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

pid process

1552 9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

description pid process

Token: SeDebugPrivilege 1552 9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

pid	process
1552	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

description	pid	process
Token: SeDebugPrivilege	1552	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

description	pid	process	target process
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
PID 1156 wrote to memory of 1552	1156	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe	9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe

C:\Users\Admin\AppData\Local\Temp\9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
"C:\Users\Admin\AppData\Local\Temp\9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe
"C:\Users\Admin\AppData\Local\Temp\9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-2-0x0000000073CB0000-0x000000007439E000-memory.dmp

Filesize
6.9MB

Download
memory/1156-3-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1156-5-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/1156-6-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/1156-7-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/1156-8-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/1156-9-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/1156-10-0x0000000004EB0000-0x0000000004EC2000-memory.dmp

Filesize
72KB

Download
memory/1156-11-0x0000000005A40000-0x0000000005A98000-memory.dmp

Filesize
352KB

Download
memory/1552-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1552-13-0x00000000004139DE-mapping.dmp

Download
memory/1552-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing