lokibot | f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445

General

Target

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
Size

265KB
MD5

1be0a2069bd64c7132f7d4a5e8eac6a7
SHA1

984eee8830f6346fb29db64652339e5d06db9076
SHA256

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445
SHA512

2a50d71738b6d5635cb34fb09fe90d7493204b7f2e24b6295ab21bf76b7138680019c08be57c6fe45da8066c8e328ffb2f4f15470e94c6d1019ff175966b8bf8

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/vSr0zAGTIr0Ki

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

description	pid	process	target process
PID 748 set thread context of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

pid process

748 f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

pid process

1900 f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

description pid process

Token: SeDebugPrivilege 1900 f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

pid	process
748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

pid	process
1900	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

description	pid	process
Token: SeDebugPrivilege	1900	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

description	pid	process	target process
PID 748 wrote to memory of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
PID 748 wrote to memory of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
PID 748 wrote to memory of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
PID 748 wrote to memory of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
PID 748 wrote to memory of 1900	748	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe	f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe

C:\Users\Admin\AppData\Local\Temp\f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
"C:\Users\Admin\AppData\Local\Temp\f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe
"C:\Users\Admin\AppData\Local\Temp\f1a3b91427ef42327cd507ceee5f3c6717e28d8e27ba6dd50cace4126de61445.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-2-0x00000000004139DE-mapping.dmp

Download
memory/1900-3-0x00000000766C1000-0x00000000766C3000-memory.dmp

Filesize
8KB

Download
memory/1900-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1988-5-0x000007FEF7D30000-0x000007FEF7FAA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing