lokibot | a91e4336af850950b1bcaec94d14e9b824ed58554c3f24256b867eae22bb2d98

Analysis

max time kernel
84s
max time network
88s
platform
windows10_x64
resource
win10v20210408
submitted
20/09/2021, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe
Size 252KB
Sample210920-rdb2qaecd7
SHA256 a91e4336af850950b1bcaec94d14e9b824ed58554c3f24256b867eae22bb2d98
MD5 01bd9c33ec13fc1d6f1e4dd90ff01c2e
SHA1 539fff3b7439d7e4afe6bd1c6cfbc609022fd117
SHA512 e8b0a149e6fe452e9dc4d83b435011437456aa4bd00ce9606801d97f325945b29cadc9984149d3b25763e49663e5b9bc63695711983a2a1e4c4b3f00fa9ca204
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://136.243.159.53/~element/page.php?id=490
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 524	1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
524	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 524	1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe	68
PID 1832 wrote to memory of 524	1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe	68
PID 1832 wrote to memory of 524	1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe	68
PID 1832 wrote to memory of 524	1832	01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe	68

C:\Users\Admin\AppData\Local\Temp\01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe
"C:\Users\Admin\AppData\Local\Temp\01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe
  "C:\Users\Admin\AppData\Local\Temp\01bd9c33ec13fc1d6f1e4dd90ff01c2e.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-116-0x0000000000400000-0x00000000004A2000-memory.dmp

Download