lokibot | e8384166957076efd104eaf0443b1cda502c5d6e3bdc3f0ea4764b5adb77ee16

General

Target

pic05678063.exe
Size

92KB
MD5

22b022a5547dbc1c9bcfb8e4d7eb440f
SHA1

952b628cb42495baf73c468d509f249d55aa7966
SHA256

c2544476ab17fd3fb816a97f08f16548a73c106cca80e1f5e185086d25a9f414
SHA512

c1a8f88047f91c4ad9b0e916d17f2c32c3fa080208d1eb77cab0ce57bb8594337d324bf99275bca1c5eb89d5dcf5898ccefa9de83efbe9a3beb2369ac6355c76

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fc2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

pic05678063.exepic05678063.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	pic05678063.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	pic05678063.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

pic05678063.exepic05678063.exe

pid process

788 pic05678063.exe
1328 pic05678063.exe
1328 pic05678063.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

pic05678063.exe

description pid process target process

PID 788 set thread context of 1328 788 pic05678063.exe pic05678063.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pic05678063.exe

pid process

788 pic05678063.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

pic05678063.exe

pid process

1328 pic05678063.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

pic05678063.exe

description pid process

Token: SeDebugPrivilege 1328 pic05678063.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pic05678063.exe

pid process

788 pic05678063.exe

pid	process
788	pic05678063.exe
1328	pic05678063.exe
1328	pic05678063.exe

description	pid	process	target process
PID 788 set thread context of 1328	788	pic05678063.exe	pic05678063.exe

pid	process
788	pic05678063.exe

pid	process
1328	pic05678063.exe

description	pid	process
Token: SeDebugPrivilege	1328	pic05678063.exe

pid	process
788	pic05678063.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

pic05678063.exe

description	pid	process	target process
PID 788 wrote to memory of 1328	788	pic05678063.exe	pic05678063.exe
PID 788 wrote to memory of 1328	788	pic05678063.exe	pic05678063.exe
PID 788 wrote to memory of 1328	788	pic05678063.exe	pic05678063.exe
PID 788 wrote to memory of 1328	788	pic05678063.exe	pic05678063.exe
PID 788 wrote to memory of 1328	788	pic05678063.exe	pic05678063.exe

C:\Users\Admin\AppData\Local\Temp\pic05678063.exe
"C:\Users\Admin\AppData\Local\Temp\pic05678063.exe"
1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\pic05678063.exe
"C:\Users\Admin\AppData\Local\Temp\pic05678063.exe"
2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-62-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/788-63-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1328-64-0x00000000004019EC-mapping.dmp

Download
memory/1328-65-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1328-67-0x00000000001B0000-0x00000000002B0000-memory.dmp

Filesize
1024KB

Download
memory/1328-69-0x0000000000401000-0x00000000004FD000-memory.dmp

Filesize
1008KB

Download

Analysis

Sharing