lokibot | 28d8de71ac5a4eceb6c2916b6d6bfe77d77f94cdc8d251fee4e14f9cfb58a87e

Analysis

max time kernel
126s
max time network
129s
platform
windows10_x64
resource
win10v20201028
submitted
03/03/2021, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dda9389cefe703811a939438581e3c4.exe
Size 162KB
Sample210303-deca91rlaj
SHA256 28d8de71ac5a4eceb6c2916b6d6bfe77d77f94cdc8d251fee4e14f9cfb58a87e
MD5 7dda9389cefe703811a939438581e3c4
SHA1 c7484b8e250afc3b97ef834ed0f0bfee5dc74b9a
SHA512 2e6689a9245114c3ee1145c6e78ac3fd693d29308cb434ce8a0337c2c3c2d62911c9a1fb6a5fae4946ba2947701859d8e5e3e0f01bb2591446d8eccece476bcc
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://becharnise.ir/fb5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
4764	7dda9389cefe703811a939438581e3c4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 4984	4764	7dda9389cefe703811a939438581e3c4.exe	72

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe
4764	7dda9389cefe703811a939438581e3c4.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4764	7dda9389cefe703811a939438581e3c4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4984	7dda9389cefe703811a939438581e3c4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	7dda9389cefe703811a939438581e3c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4984	4764	7dda9389cefe703811a939438581e3c4.exe	72
PID 4764 wrote to memory of 4984	4764	7dda9389cefe703811a939438581e3c4.exe	72
PID 4764 wrote to memory of 4984	4764	7dda9389cefe703811a939438581e3c4.exe	72
PID 4764 wrote to memory of 4984	4764	7dda9389cefe703811a939438581e3c4.exe	72

C:\Users\Admin\AppData\Local\Temp\7dda9389cefe703811a939438581e3c4.exe
"C:\Users\Admin\AppData\Local\Temp\7dda9389cefe703811a939438581e3c4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\7dda9389cefe703811a939438581e3c4.exe
  "C:\Users\Admin\AppData\Local\Temp\7dda9389cefe703811a939438581e3c4.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4984-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Download