lokibot | 93df7f1de03ce9fe65fb9acaef08adb8b12e4fca1c6ae3333cdf2563d161268a

Analysis

max time kernel
131s
max time network
134s
platform
windows10_x64
resource
win10v20210408
submitted
03/05/2021, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SN-346.exe
Size 329KB
Sample210503-szdgr7a3cn
SHA256 93df7f1de03ce9fe65fb9acaef08adb8b12e4fca1c6ae3333cdf2563d161268a
MD5 3d2fc0f796d61d90f61eb1b8ba1180ef
SHA1 6061ad91667b984855fbf9f5ff97103dd46047a7
SHA512 9d52100ecae3f8ab8b3b32b6abbd52cbe0da6d96536eaca260199b9fb96769adb373d72644c478b6536217aa605fe9e3ad636bcbd4abb248e7e111fe83a4f542
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://209.141.50.70/D3/13/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
4656	SN-346.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 3596	4656	SN-346.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4656	SN-346.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3596	4656	SN-346.exe	75
PID 4656 wrote to memory of 3596	4656	SN-346.exe	75
PID 4656 wrote to memory of 3596	4656	SN-346.exe	75
PID 4656 wrote to memory of 3596	4656	SN-346.exe	75

C:\Users\Admin\AppData\Local\Temp\SN-346.exe
"C:\Users\Admin\AppData\Local\Temp\SN-346.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\SN-346.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-117-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4656-116-0x00000000023B0000-0x00000000023B2000-memory.dmp