lokibot | 0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3

General

Target

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
Size

654KB
MD5

4401d62f459d17975cb9cf5b379cea96
SHA1

d02cf59cdd52a6d922c0f2a6dae333a97c6687a9
SHA256

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3
SHA512

beac402156ea23077bcc8e105fd3706b3e6e561e0d3a39e567c111446fcee3657e7ae6ed339c4bcf238f0d4bb401e8a8afbd00377762efea8c1ab63bd634a14f

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://lmpulsefashion.net/chief/kev/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

description	pid	process	target process
PID 1400 set thread context of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

pid process

212 0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

description pid process

Token: SeDebugPrivilege 212 0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

pid	process
212	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

description	pid	process
Token: SeDebugPrivilege	212	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

description	pid	process	target process
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
PID 1400 wrote to memory of 212	1400	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe	0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe

C:\Users\Admin\AppData\Local\Temp\0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
"C:\Users\Admin\AppData\Local\Temp\0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe
"C:\Users\Admin\AppData\Local\Temp\0b2ae98dbbc89e15b3d0864559fede5bf9a7c96e80476499c24bf396a5fd27f3.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/212-13-0x00000000004139DE-mapping.dmp

Download
memory/212-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1400-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/1400-3-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/1400-5-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1400-6-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1400-7-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1400-8-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/1400-9-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/1400-10-0x0000000004E90000-0x0000000004EA2000-memory.dmp

Filesize
72KB

Download
memory/1400-11-0x0000000005B70000-0x0000000005BC2000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing