lokibot | 45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51

General

Target

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
Size

697KB
MD5

917dc0ea02f9597e9d43236fa9f7d637
SHA1

e8904f56591df4148ac911e9851e073a90a120f2
SHA256

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51
SHA512

0e8250130083e8343e8039fa06ad60dacda573eb076adaa047639f866e01461939c5cf83c1ece2988d0e5cc4baf63d0b6a105b402abe303255ee9f84695b6021

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/S4wFP8QBww9Tp

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

description	pid	process	target process
PID 3908 set thread context of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

pid	process
3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

pid process

3132 45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

pid	process
3132	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

description	pid	process
Token: SeDebugPrivilege	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
Token: SeDebugPrivilege	3132	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

description	pid	process	target process
PID 3908 wrote to memory of 3376	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3376	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3376	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
PID 3908 wrote to memory of 3132	3908	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe	45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe

C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
"C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
"C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe"
2⤵
PID:3376

C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe
"C:\Users\Admin\AppData\Local\Temp\45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3132-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3132-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3132-126-0x00000000004139DE-mapping.dmp

Download
memory/3908-121-0x0000000004AE0000-0x0000000004FDE000-memory.dmp

Filesize
5.0MB

Download
memory/3908-119-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/3908-120-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3908-114-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/3908-122-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/3908-123-0x00000000055E0000-0x0000000005678000-memory.dmp

Filesize
608KB

Download
memory/3908-124-0x0000000006AD0000-0x0000000006B37000-memory.dmp

Filesize
412KB

Download
memory/3908-118-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/3908-117-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3908-116-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads