lokibot | 025e7d82b84e5c036744c45aeb56499ae62362d0b115dd2ae7304c728bb27efb

Analysis

max time kernel
124s
max time network
127s
platform
windows10_x64
resource
win10v20201028
submitted
17/03/2021, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e898039c39f0834f8d2dc00b6118f55.exe
Size 154KB
Sample210317-6sm2n561p2
SHA256 025e7d82b84e5c036744c45aeb56499ae62362d0b115dd2ae7304c728bb27efb
MD5 0e898039c39f0834f8d2dc00b6118f55
SHA1 9b18f8490bfc6926b9839f1182ef76587046717c
SHA512 4eac7b728fa1026c858bf23b44b06b5dd992773c3fe12e262eea679374d1f71fc0ec4620b979389d2cd6da8e95786c9394888d22f0c2171e7d5be5efe9138f85
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://interocean-my.com/zoro/zoro6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
4012	0e898039c39f0834f8d2dc00b6118f55.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 520	4012	0e898039c39f0834f8d2dc00b6118f55.exe	71

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe
4012	0e898039c39f0834f8d2dc00b6118f55.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4012	0e898039c39f0834f8d2dc00b6118f55.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
520	0e898039c39f0834f8d2dc00b6118f55.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	0e898039c39f0834f8d2dc00b6118f55.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 520	4012	0e898039c39f0834f8d2dc00b6118f55.exe	71
PID 4012 wrote to memory of 520	4012	0e898039c39f0834f8d2dc00b6118f55.exe	71
PID 4012 wrote to memory of 520	4012	0e898039c39f0834f8d2dc00b6118f55.exe	71
PID 4012 wrote to memory of 520	4012	0e898039c39f0834f8d2dc00b6118f55.exe	71

C:\Users\Admin\AppData\Local\Temp\0e898039c39f0834f8d2dc00b6118f55.exe
"C:\Users\Admin\AppData\Local\Temp\0e898039c39f0834f8d2dc00b6118f55.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\0e898039c39f0834f8d2dc00b6118f55.exe
  "C:\Users\Admin\AppData\Local\Temp\0e898039c39f0834f8d2dc00b6118f55.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Download