lokibot | ec7ed5439c52dd30d70a2bbf16a6b217f3a8720c2ee6f0847d7483ff55a50a84

General

Target
411d1d65795efcf9b4a5e68b7122d7bc.exe
Size 959KB
Sample210324-vsfe68ymb2
SHA256 ec7ed5439c52dd30d70a2bbf16a6b217f3a8720c2ee6f0847d7483ff55a50a84
MD5 411d1d65795efcf9b4a5e68b7122d7bc
SHA1 124c0130dbb1dccdf33c987e7bd96c7ca02ed8df
SHA512 2fc2fb4885aaac5582cdc18da9e830fa38e555451f3bab851100316f31dede0faf996c494ce5db3dd14df1bf41447c83f5c097928343242e39ce957a9964ddb9
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://interplasts-uae.com/coco/coco4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1044	411d1d65795efcf9b4a5e68b7122d7bc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
732	411d1d65795efcf9b4a5e68b7122d7bc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe
Token: SeDebugPrivilege	732	411d1d65795efcf9b4a5e68b7122d7bc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1000	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	29
PID 1044 wrote to memory of 1000	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	29
PID 1044 wrote to memory of 1000	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	29
PID 1044 wrote to memory of 1000	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	29
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30
PID 1044 wrote to memory of 732	1044	411d1d65795efcf9b4a5e68b7122d7bc.exe	30

C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe
"C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe
  "C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe"
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe
  "C:\Users\Admin\AppData\Local\Temp\411d1d65795efcf9b4a5e68b7122d7bc.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/732-10-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/732-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1044-2-0x0000000074110000-0x00000000747FE000-memory.dmp

Download

memory/1044-3-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/1044-5-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1044-6-0x00000000005F0000-0x00000000005FB000-memory.dmp

Download

memory/1044-7-0x00000000022B0000-0x0000000002327000-memory.dmp

Download

memory/1092-11-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads