lokibot | 96502f45d9fa8235052025a0edfb89ce841b2b188259c870626f499ed68116a9

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20210410
submitted
03/07/2021, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
Size 690KB
Sample210703-zbj4clzpg2
SHA256 96502f45d9fa8235052025a0edfb89ce841b2b188259c870626f499ed68116a9
MD5 3ca86b064f7a59ea99ec5e7b30aad3c0
SHA1 0cd88be35ba015193a9b9b2a3ac0e8f2c1c14026
SHA512 68fd86a82fec532270449c2c1ad06a6036924739aee0d58a27c2dc6b35423f7d7990382e8cac89b1ac0184ab7e63b8bf6d4f60abd16f6f904c3fa557c2ec5b7d
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://mahetechasia.com/data/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 1540	3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe	72

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1540	3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe	72
PID 3416 wrote to memory of 1540	3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe	72
PID 3416 wrote to memory of 1540	3416	3CA86B064F7A59EA99EC5E7B30AAD3C0.exe	72

C:\Users\Admin\AppData\Local\Temp\3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
"C:\Users\Admin\AppData\Local\Temp\3CA86B064F7A59EA99EC5E7B30AAD3C0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
  "C:\Users\Admin\AppData\Local\Temp\3CA86B064F7A59EA99EC5E7B30AAD3C0.exe"
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-118-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3416-115-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/3416-116-0x0000000000680000-0x000000000068B000-memory.dmp

Download

memory/3416-117-0x0000000002250000-0x0000000002251000-memory.dmp

Download