lokibot | eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de

General

Target

c08c591f773ecee016ad60496e99ac49.exe
Size

806KB
MD5

c08c591f773ecee016ad60496e99ac49
SHA1

6326dac07e8db5d9c4b328e81e806cd9449eca9a
SHA256

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de
SHA512

834ef514a5e7e1a06cb38fbadc04b62caf80f0a31feb06ad9534799e99ba90a92c6d04bba31c878df84ee9d5f1af35562a533ded54c37d003f9a16009f07d6e8

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://lmpulsefashion.net/chief/boss/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

description pid process target process

PID 1992 set thread context of 1960 1992 c08c591f773ecee016ad60496e99ac49.exe c08c591f773ecee016ad60496e99ac49.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

pid process

1992 c08c591f773ecee016ad60496e99ac49.exe
1992 c08c591f773ecee016ad60496e99ac49.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

pid process

1960 c08c591f773ecee016ad60496e99ac49.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exec08c591f773ecee016ad60496e99ac49.exe

description pid process

Token: SeDebugPrivilege 1992 c08c591f773ecee016ad60496e99ac49.exe
Token: SeDebugPrivilege 1960 c08c591f773ecee016ad60496e99ac49.exe

description	pid	process	target process
PID 1992 set thread context of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe

pid	process
1992	c08c591f773ecee016ad60496e99ac49.exe
1992	c08c591f773ecee016ad60496e99ac49.exe

pid	process
1960	c08c591f773ecee016ad60496e99ac49.exe

description	pid	process
Token: SeDebugPrivilege	1992	c08c591f773ecee016ad60496e99ac49.exe
Token: SeDebugPrivilege	1960	c08c591f773ecee016ad60496e99ac49.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

description	pid	process	target process
PID 1992 wrote to memory of 1928	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1928	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1928	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1928	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 1992 wrote to memory of 1960	1992	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe

C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe
"C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe
"C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe"
2⤵
PID:1928

C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe
"C:\Users\Admin\AppData\Local\Temp\c08c591f773ecee016ad60496e99ac49.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-10-0x000007FEF7020000-0x000007FEF729A000-memory.dmp

Filesize
2.5MB

Download
memory/1960-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-8-0x00000000004139DE-mapping.dmp

Download
memory/1960-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1992-2-0x0000000073AF0000-0x00000000741DE000-memory.dmp

Filesize
6.9MB

Download
memory/1992-3-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/1992-5-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/1992-6-0x00000000012A0000-0x00000000012F2000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing