lokibot | 297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1

General

Target

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
Size

1011KB
MD5

060eada71f4d9832ebc38b5e66444dd7
SHA1

d9d7b08ae7a8ff61626a995e995cac8773c3bfc7
SHA256

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1
SHA512

273d9a649f9a0bf67a7a9f2f015f3280d07775379ac3568493bb4ed0fc25f3bc90f40327b44fedb6c0c08f73788237806b9ce8c9e2cda849bf7c301f8118f780

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/com/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

description	pid	process	target process
PID 1824 set thread context of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

pid process

1652 297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

description pid process

Token: SeDebugPrivilege 1652 297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

pid	process
1652	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

description	pid	process
Token: SeDebugPrivilege	1652	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

description	pid	process	target process
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
PID 1824 wrote to memory of 1652	1824	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe	297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe

C:\Users\Admin\AppData\Local\Temp\297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
"C:\Users\Admin\AppData\Local\Temp\297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe
  "C:\Users\Admin\AppData\Local\Temp\297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1652-67-0x00000000004139DE-mapping.dmp

Download
memory/1652-68-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1652-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1824-60-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/1824-62-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1824-63-0x00000000004B0000-0x00000000004CB000-memory.dmp

Filesize
108KB

Download
memory/1824-64-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/1824-65-0x0000000000C20000-0x0000000000C41000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing