lokibot | f70bb08ecbd6548a7a3a52a0a2a151e87af472b185dd1adaa718a87a340e777b

General

Target
0392453270a71b5a7a29b8c8d415978f.exe
Size 871KB
Sample210729-8f5ftk9d9e
SHA256 f70bb08ecbd6548a7a3a52a0a2a151e87af472b185dd1adaa718a87a340e777b
MD5 0392453270a71b5a7a29b8c8d415978f
SHA1 37869819f38607bb0f2a30f05573dfed03136d62
SHA512 de18b7c5379d46523e77288a7ac4f0b02f3f343657bec79c7741c3a5f32d350c57821d9c2aabdadbf26c2b74e2cdcefc2e75026d3099b94a4d14ba8580c5e1b2
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/856-122-0x0000000001030000-0x000000000103B000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1600	0392453270a71b5a7a29b8c8d415978f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	0392453270a71b5a7a29b8c8d415978f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78
PID 856 wrote to memory of 1600	856	0392453270a71b5a7a29b8c8d415978f.exe	78

C:\Users\Admin\AppData\Local\Temp\0392453270a71b5a7a29b8c8d415978f.exe
"C:\Users\Admin\AppData\Local\Temp\0392453270a71b5a7a29b8c8d415978f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\0392453270a71b5a7a29b8c8d415978f.exe
  "C:\Users\Admin\AppData\Local\Temp\0392453270a71b5a7a29b8c8d415978f.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-114-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/856-116-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/856-117-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/856-118-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/856-119-0x0000000002B90000-0x0000000002B91000-memory.dmp

Download

memory/856-120-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/856-121-0x00000000051A0000-0x000000000569E000-memory.dmp

Download

memory/856-122-0x0000000001030000-0x000000000103B000-memory.dmp

Download

memory/856-123-0x0000000007770000-0x00000000077D1000-memory.dmp

Download

memory/856-124-0x0000000005670000-0x000000000568D000-memory.dmp

Download

memory/1600-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1600-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads