lokibot | cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

General

Target

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
Size

536KB
MD5

2402f165befaa33e3700592cb7defe4c
SHA1

e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
SHA256

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
SHA512

ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process	target process
PID 308 set thread context of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

pid	process
308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

pid process

1504 cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

pid	process
1504	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.execd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process
Token: SeDebugPrivilege	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
Token: SeDebugPrivilege	1504	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

description	pid	process	target process
PID 308 wrote to memory of 1544	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1544	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1544	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1544	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
PID 308 wrote to memory of 1504	308	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe	cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe

C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
"C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
"{path}"
2⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-60-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/308-62-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/308-63-0x0000000000940000-0x0000000000942000-memory.dmp

Filesize
8KB

Download
memory/308-64-0x0000000007DD0000-0x0000000007E3B000-memory.dmp

Filesize
428KB

Download
memory/308-65-0x0000000001FE0000-0x0000000002002000-memory.dmp

Filesize
136KB

Download
memory/1504-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1504-67-0x00000000004139DE-mapping.dmp

Download
memory/1504-68-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1504-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads