lokibot | 092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb

General

Target

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
Size

749KB
MD5

7c0158f3cf2b6d843226e3a1a86cc11f
SHA1

15667c2460d0f3d9908daf6c1d6f24b04225cc35
SHA256

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb
SHA512

c25b94bba7b6d964ee48f1c06ce7a84330182427cc52e12e0f9dd1da1653491e916d26ff5f914cda507573753cf782f507a5111666d904d33f2a7dec64f988a9

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://lmpulsefashion.net/chief/boss/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

description	pid	process	target process
PID 3888 set thread context of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

pid process

3548 092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

description pid process

Token: SeDebugPrivilege 3548 092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

pid	process
3548	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

description	pid	process
Token: SeDebugPrivilege	3548	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

description	pid	process	target process
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
PID 3888 wrote to memory of 3548	3888	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe	092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe

C:\Users\Admin\AppData\Local\Temp\092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
"C:\Users\Admin\AppData\Local\Temp\092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe
  "C:\Users\Admin\AppData\Local\Temp\092079f16dc67cf3ebe88fbe156ebf31218cf741e3433b77a45a355b63ace9eb.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3548-13-0x00000000004139DE-mapping.dmp

Download
memory/3548-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/3888-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3888-5-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/3888-6-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/3888-7-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/3888-8-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/3888-9-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/3888-10-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/3888-11-0x0000000006220000-0x0000000006278000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing