lokibot | 89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c

General

Target

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
Size

251KB
MD5

c8bdd96544c62d471d6fdafc50fe3d1c
SHA1

077f24abd08aa3d85546705c2fd61f687bf60649
SHA256

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c
SHA512

510592db387feea939987017f2cc233a0058a08ea12a0d11c1ff8be427ab9640ee2a3d4b1c8d3621d1fcaf5568f3914295739f236004ffbdabae6f63ed54c9b5

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://accountsdomainsupport.ga/BN2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

description	pid	process	target process
PID 4012 set thread context of 2504	4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

pid process

4012 89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

pid process

2504 89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

description pid process

Token: SeDebugPrivilege 2504 89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

pid	process
4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

pid	process
2504	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

description	pid	process
Token: SeDebugPrivilege	2504	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

description	pid	process	target process
PID 4012 wrote to memory of 2504	4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
PID 4012 wrote to memory of 2504	4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
PID 4012 wrote to memory of 2504	4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
PID 4012 wrote to memory of 2504	4012	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe	89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe

C:\Users\Admin\AppData\Local\Temp\89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
"C:\Users\Admin\AppData\Local\Temp\89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4012

C:\Users\Admin\AppData\Local\Temp\89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe
"C:\Users\Admin\AppData\Local\Temp\89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-114-0x00000000004139DE-mapping.dmp

Download
memory/2504-116-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4012-115-0x0000000000410000-0x00000000004BE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing