lokibot | c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190

General

Target

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
Size

538KB
MD5

3965feca216cde849f987b614794b46c
SHA1

d5fd435edf3348930b1500d9b10b3b010b07ef99
SHA256

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
SHA512

684381a00700a14c9c0bb9b4cb337f00057ccd678c825b3ab3b578ee6a98dd7c8a46fb42734be7a51dbb47ef21d03929428ab17ef2be327259d8c99439757c5b

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

https://zamloki.xyz/des/co/tox.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

description	pid	process	target process
PID 4024 set thread context of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

pid process

3156 c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

description pid process

Token: SeDebugPrivilege 3156 c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

pid	process
3156	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

description	pid	process
Token: SeDebugPrivilege	3156	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

description	pid	process	target process
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
PID 4024 wrote to memory of 3156	4024	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe

C:\Users\Admin\AppData\Local\Temp\c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
"C:\Users\Admin\AppData\Local\Temp\c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4024

C:\Users\Admin\AppData\Local\Temp\c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3156-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3156-125-0x00000000004139DE-mapping.dmp

Download
memory/3156-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4024-114-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4024-116-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/4024-117-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/4024-118-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/4024-119-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/4024-120-0x0000000005720000-0x0000000005722000-memory.dmp

Filesize
8KB

Download
memory/4024-121-0x0000000008830000-0x0000000008831000-memory.dmp

Filesize
4KB

Download
memory/4024-122-0x0000000006E30000-0x0000000006E9C000-memory.dmp

Filesize
432KB

Download
memory/4024-123-0x0000000006FC0000-0x0000000006FE1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing