lokibot | 9f5be050c4fe63704809ba4d8b65bb1d52e54b87bcbd5d65ab2ffdf73e7b5400

Analysis

max time kernel
76s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
12/02/2021, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Advice_xlsx.exe
Size 164KB
Sample210212-e5yc3bw616
SHA256 9f5be050c4fe63704809ba4d8b65bb1d52e54b87bcbd5d65ab2ffdf73e7b5400
MD5 dea3789b6a3c8ef6f5406e2925506c4e
SHA1 cca57f3d3bda0e7b6b36c04ec1ecb747c46c2193
SHA512 f5f3ae06e0a6220d41fec394319e0c6d45428ad960a849476a0d534b43bacc18af7455abd764e4d55d09e351004796c850a4584e76b16f268fc29c50ce32ef34
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://atlasqrp.com/ari/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 2 IoCs

pid	Process
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 2512	528	Payment Advice_xlsx.exe	75

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe
528	Payment Advice_xlsx.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
528	Payment Advice_xlsx.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	Payment Advice_xlsx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	Payment Advice_xlsx.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2512	528	Payment Advice_xlsx.exe	75
PID 528 wrote to memory of 2512	528	Payment Advice_xlsx.exe	75
PID 528 wrote to memory of 2512	528	Payment Advice_xlsx.exe	75
PID 528 wrote to memory of 2512	528	Payment Advice_xlsx.exe	75

C:\Users\Admin\AppData\Local\Temp\Payment Advice_xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice_xlsx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\Payment Advice_xlsx.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Advice_xlsx.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Download