lokibot | fa69036fcd3c1fb0476f36736674a923ff327c2ff1d9958ee5c3961b176d83a2

Analysis

max time kernel
90s
max time network
126s
platform
windows10_x64
resource
win10v20210410
submitted
09/08/2021, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
164F0886AE383079BBA01BEDDBD7E8FF.exe
Size 1.6MB
Sample210809-rr6r35z8ae
SHA256 fa69036fcd3c1fb0476f36736674a923ff327c2ff1d9958ee5c3961b176d83a2
MD5 164f0886ae383079bba01beddbd7e8ff
SHA1 f0955b56db82a205996245fde7ecfef3eb3046e2
SHA512 a18ef0338ff25d6ee479ee01530af88f25b98b66a6c4b8fc72635d93a9c8c4b61d86f4498d1be934f0774adb9c61d14cdedc76fe7d40c6df7539cf6fff97fe25
MD5 SHA1 SHA512

Score

10^/10

lokibot persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://craftdistilleries.com/auth/xloki/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	164F0886AE383079BBA01BEDDBD7E8FF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\164F0886AE383079BBA01BEDDBD7E8FF.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ASound.exe"	164F0886AE383079BBA01BEDDBD7E8FF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1316	164F0886AE383079BBA01BEDDBD7E8FF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	164F0886AE383079BBA01BEDDBD7E8FF.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79
PID 3980 wrote to memory of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79
PID 3980 wrote to memory of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79
PID 3980 wrote to memory of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79
PID 3980 wrote to memory of 1316	3980	164F0886AE383079BBA01BEDDBD7E8FF.exe	79

C:\Users\Admin\AppData\Local\Temp\164F0886AE383079BBA01BEDDBD7E8FF.exe
"C:\Users\Admin\AppData\Local\Temp\164F0886AE383079BBA01BEDDBD7E8FF.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\164F0886AE383079BBA01BEDDBD7E8FF.exe
  "C:\Users\Admin\AppData\Local\Temp\164F0886AE383079BBA01BEDDBD7E8FF.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-115-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1316-117-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3980-114-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads