lokibot | 5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130

General

Target

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
Size

850KB
MD5

36a2cb65a1ecc54011a92958733a92a9
SHA1

095e985a298f9874b0a6414780d00ad6437ebcf7
SHA256

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130
SHA512

6c988738d86cab8c46bbff20b9adf595437cda8b2fabbb7f3e359510f50b3cee8362f3490491ea3779b596b2060a89eebf22ea743a291657e82d4a6bb8c1386c

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/S4wFP8QBww9Tp

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process	target process
PID 1652 set thread context of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid	process
1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid process

664 5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid	process
664	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process
Token: SeDebugPrivilege	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
Token: SeDebugPrivilege	664	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process	target process
PID 1652 wrote to memory of 520	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 520	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 520	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 520	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 1652 wrote to memory of 664	1652	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
"C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
"C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe"
2⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
"C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/664-66-0x00000000004139DE-mapping.dmp

Download
memory/664-67-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download
memory/664-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1652-59-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/1652-61-0x0000000007010000-0x0000000007011000-memory.dmp

Filesize
4KB

Download
memory/1652-62-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/1652-63-0x0000000007630000-0x00000000076AF000-memory.dmp

Filesize
508KB

Download
memory/1652-64-0x0000000000E20000-0x0000000000E6A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads