lokibot | eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de

General

Target

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
Size

806KB
MD5

c08c591f773ecee016ad60496e99ac49
SHA1

6326dac07e8db5d9c4b328e81e806cd9449eca9a
SHA256

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de
SHA512

834ef514a5e7e1a06cb38fbadc04b62caf80f0a31feb06ad9534799e99ba90a92c6d04bba31c878df84ee9d5f1af35562a533ded54c37d003f9a16009f07d6e8

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://lmpulsefashion.net/chief/boss/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

description	pid	process	target process
PID 4756 set thread context of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

pid process

3200 eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

description pid process

Token: SeDebugPrivilege 3200 eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

pid	process
3200	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

description	pid	process
Token: SeDebugPrivilege	3200	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

description	pid	process	target process
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
PID 4756 wrote to memory of 3200	4756	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe	eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe

C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
"C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756

C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe
"C:\Users\Admin\AppData\Local\Temp\eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3200-13-0x00000000004139DE-mapping.dmp

Download
memory/3200-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4756-2-0x0000000073150000-0x000000007383E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-3-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/4756-5-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/4756-6-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/4756-7-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/4756-8-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/4756-9-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/4756-10-0x0000000005B20000-0x0000000005B32000-memory.dmp

Filesize
72KB

Download
memory/4756-11-0x0000000006570000-0x00000000065C2000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing