lokibot | 92d4b242b26d427316aa1dc970f02a9406014d8546a5ca863be690d982dad7b7

General

Target
long pending invoices.exe
Size 610KB
Sample210906-hl1klsdgem
SHA256 92d4b242b26d427316aa1dc970f02a9406014d8546a5ca863be690d982dad7b7
MD5 b780d8876021ed861a49c9bd0f411b15
SHA1 75347f40582aa16770ed8a42b6b95961f1085808
SHA512 28851be528e366e18d1ca34222cd051a18cf812066cac295e6278ed234110f7fcb4495bf95f7516c5862632d9809cc9672075e07e1d014e691b8cc118cf55dc5
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://frembonga.ga/binge/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 4440	4720	long pending invoices.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe
4720	long pending invoices.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4440	long pending invoices.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	long pending invoices.exe
Token: SeDebugPrivilege	4440	long pending invoices.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4540	4720	long pending invoices.exe	79
PID 4720 wrote to memory of 4540	4720	long pending invoices.exe	79
PID 4720 wrote to memory of 4540	4720	long pending invoices.exe	79
PID 4720 wrote to memory of 4512	4720	long pending invoices.exe	80
PID 4720 wrote to memory of 4512	4720	long pending invoices.exe	80
PID 4720 wrote to memory of 4512	4720	long pending invoices.exe	80
PID 4720 wrote to memory of 4524	4720	long pending invoices.exe	81
PID 4720 wrote to memory of 4524	4720	long pending invoices.exe	81
PID 4720 wrote to memory of 4524	4720	long pending invoices.exe	81
PID 4720 wrote to memory of 4560	4720	long pending invoices.exe	82
PID 4720 wrote to memory of 4560	4720	long pending invoices.exe	82
PID 4720 wrote to memory of 4560	4720	long pending invoices.exe	82
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83
PID 4720 wrote to memory of 4440	4720	long pending invoices.exe	83

C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
"C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
  2⤵
  PID:4512
- C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\long pending invoices.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4440-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4440-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4720-115-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/4720-117-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/4720-118-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/4720-119-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/4720-120-0x0000000005280000-0x0000000005296000-memory.dmp

Download

memory/4720-121-0x0000000007490000-0x0000000007491000-memory.dmp

Download

memory/4720-122-0x00000000050E0000-0x00000000055DE000-memory.dmp

Download

memory/4720-123-0x00000000073F0000-0x0000000007440000-memory.dmp

Download

memory/4720-124-0x0000000009B20000-0x0000000009B3D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads