lokibot | 61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc

General

Target

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
Size

602KB
MD5

f3a4f1cc5720b34b682d65f04bd122fe
SHA1

9918b2802596f7185e71b21cb9a9ff6001d93c01
SHA256

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc
SHA512

4f1b4c2f24dfd559be01f2f66c29b6e225cb7a6df1fb4d398b64a10984d744e5a7ec44fd7a6fab0e39ec1d8086638f734f4679a7fb263027ff698413aa5dceb8

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd5/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/4068-121-0x00000000051C0000-0x00000000051CB000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

description	pid	process	target process
PID 4068 set thread context of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

pid process

3940 61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

description pid process

Token: SeDebugPrivilege 3940 61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

pid	process
3940	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

description	pid	process
Token: SeDebugPrivilege	3940	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

description	pid	process	target process
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
PID 4068 wrote to memory of 3940	4068	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe	61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe

C:\Users\Admin\AppData\Local\Temp\61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
"C:\Users\Admin\AppData\Local\Temp\61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068

C:\Users\Admin\AppData\Local\Temp\61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe
"C:\Users\Admin\AppData\Local\Temp\61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3940-125-0x00000000004139DE-mapping.dmp

Download
memory/3940-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4068-114-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/4068-116-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/4068-117-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/4068-118-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/4068-119-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/4068-120-0x0000000004CE0000-0x00000000051DE000-memory.dmp

Filesize
5.0MB

Download
memory/4068-121-0x00000000051C0000-0x00000000051CB000-memory.dmp

Filesize
44KB

Download
memory/4068-122-0x00000000070D0000-0x0000000007130000-memory.dmp

Filesize
384KB

Download
memory/4068-123-0x0000000007140000-0x0000000007161000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads