lokibot | 8dc3d4e2fe3d376b13ae0ff882d26d69fe06a72ab549f005b8e76beef5b3b548

General

Target
PO#PDT28394209.exe
Size 750KB
Sample210129-ves6tx17ja
SHA256 8dc3d4e2fe3d376b13ae0ff882d26d69fe06a72ab549f005b8e76beef5b3b548
MD5 d6f609adcdbd0ac294cc27ee07cb0ba2
SHA1 534f04d2acfec8795610d72238a8a9322d86fb60
SHA512 2293810ebf523e9b72df335bce22bbf324429f3ef522cf53ce1c0e29acb1b32d2803325c0e987fd4ecfc996752d0a72a91c58a302c3e6b29cf5b5d73193a8c15
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://pearl-energia-hu.ml/h1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 3244	3920	PO#PDT28394209.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	PO#PDT28394209.exe
3920	PO#PDT28394209.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3244	PO#PDT28394209.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	PO#PDT28394209.exe
Token: SeDebugPrivilege	3244	PO#PDT28394209.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 932	3920	PO#PDT28394209.exe	78
PID 3920 wrote to memory of 932	3920	PO#PDT28394209.exe	78
PID 3920 wrote to memory of 932	3920	PO#PDT28394209.exe	78
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79
PID 3920 wrote to memory of 3244	3920	PO#PDT28394209.exe	79

C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe
"C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe"
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe
  "C:\Users\Admin\AppData\Local\Temp\PO#PDT28394209.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3244-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3920-9-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/3920-7-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/3920-8-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/3920-2-0x0000000073BA0000-0x000000007428E000-memory.dmp

Download

memory/3920-10-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/3920-11-0x0000000005030000-0x0000000005033000-memory.dmp

Download

memory/3920-12-0x0000000005BE0000-0x0000000005C71000-memory.dmp

Download

memory/3920-6-0x00000000053A0000-0x00000000053A1000-memory.dmp

Download

memory/3920-5-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/3920-3-0x0000000000480000-0x0000000000481000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads