lokibot | 2b092204fefa727fd5a2e73af2c92cf37a6b249147f2f2a6ebe70e7fc04d703e

Analysis

max time kernel
125s
max time network
125s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5fb57232f9a7f2707959b4f7e041626.exe
Size 159KB
Sample210331-37q5sd7f4j
SHA256 2b092204fefa727fd5a2e73af2c92cf37a6b249147f2f2a6ebe70e7fc04d703e
MD5 c5fb57232f9a7f2707959b4f7e041626
SHA1 a3a19daf276191bda43dc95a017f290fb2f93912
SHA512 f951b7e3ef130561f28f236b4751c9bf2b8ec649b34aabf0600e4c12dbf314e65d46c5a3831235383f1f3f2e2d0c230a563753d2b0f5471b39376d3dfdf0e30e
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://becharnise.ir/fb17/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
1576	c5fb57232f9a7f2707959b4f7e041626.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1576	c5fb57232f9a7f2707959b4f7e041626.exe
1576	c5fb57232f9a7f2707959b4f7e041626.exe
1576	c5fb57232f9a7f2707959b4f7e041626.exe
1576	c5fb57232f9a7f2707959b4f7e041626.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1576	c5fb57232f9a7f2707959b4f7e041626.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	c5fb57232f9a7f2707959b4f7e041626.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	c5fb57232f9a7f2707959b4f7e041626.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26
PID 1576 wrote to memory of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26
PID 1576 wrote to memory of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26
PID 1576 wrote to memory of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26
PID 1576 wrote to memory of 1964	1576	c5fb57232f9a7f2707959b4f7e041626.exe	26

C:\Users\Admin\AppData\Local\Temp\c5fb57232f9a7f2707959b4f7e041626.exe
"C:\Users\Admin\AppData\Local\Temp\c5fb57232f9a7f2707959b4f7e041626.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\c5fb57232f9a7f2707959b4f7e041626.exe
  "C:\Users\Admin\AppData\Local\Temp\c5fb57232f9a7f2707959b4f7e041626.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-2-0x0000000075A41000-0x0000000075A43000-memory.dmp

Download

memory/1924-6-0x000007FEF6780000-0x000007FEF69FA000-memory.dmp

Download

memory/1964-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Download