lokibot | 5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130

General

Target

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
Size

850KB
MD5

36a2cb65a1ecc54011a92958733a92a9
SHA1

095e985a298f9874b0a6414780d00ad6437ebcf7
SHA256

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130
SHA512

6c988738d86cab8c46bbff20b9adf595437cda8b2fabbb7f3e359510f50b3cee8362f3490491ea3779b596b2060a89eebf22ea743a291657e82d4a6bb8c1386c

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/S4wFP8QBww9Tp

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process	target process
PID 644 set thread context of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid	process
644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid process

3128 5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

pid	process
3128	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process
Token: SeDebugPrivilege	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
Token: SeDebugPrivilege	3128	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

description	pid	process	target process
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
PID 644 wrote to memory of 3128	644	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe	5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe

C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
"C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe
"C:\Users\Admin\AppData\Local\Temp\5d6b7ef677711fc8e227f7c37c2e13a696fe34a4c2982f9a3d194e453eb33130.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-114-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/644-116-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/644-117-0x00000000085E0000-0x00000000085E1000-memory.dmp

Filesize
4KB

Download
memory/644-118-0x0000000008180000-0x0000000008181000-memory.dmp

Filesize
4KB

Download
memory/644-119-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/644-120-0x0000000007F20000-0x0000000007F21000-memory.dmp

Filesize
4KB

Download
memory/644-121-0x0000000008220000-0x0000000008221000-memory.dmp

Filesize
4KB

Download
memory/644-122-0x0000000008170000-0x0000000008180000-memory.dmp

Filesize
64KB

Download
memory/644-123-0x000000000A630000-0x000000000A6AF000-memory.dmp

Filesize
508KB

Download
memory/644-124-0x0000000003240000-0x000000000328A000-memory.dmp

Filesize
296KB

Download
memory/3128-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3128-126-0x00000000004139DE-mapping.dmp

Download
memory/3128-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads