lokibot | c233d4f4d91b4caafdfaa0ddb84a9ad30436719de65f9c17eaeb8cde8663edbd

Analysis

max time kernel
103s
max time network
52s
platform
windows7_x64
resource
win7v20210408
submitted
21/09/2021, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT COPY_002109.exe
Size 246KB
Sample210921-eynj2agah5
SHA256 c233d4f4d91b4caafdfaa0ddb84a9ad30436719de65f9c17eaeb8cde8663edbd
MD5 f0074cc335d44cbda666781d065c504e
SHA1 0e3954cdf0100ea58efe3f53d78024df5f599baf
SHA512 5f3ca4b6b1e17427bbd5ff56be3d108f0cd5ad8d99184d4ee5e3f823db64778cd9287a7fd07797c1383d09aa2165a08a2082b749d5a595b2fb858bc7f8396faa
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://136.243.159.53/~element/page.php?id=485
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
368	TT COPY_002109.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 760	368	TT COPY_002109.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
368	TT COPY_002109.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
760	TT COPY_002109.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	TT COPY_002109.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 760	368	TT COPY_002109.exe	27
PID 368 wrote to memory of 760	368	TT COPY_002109.exe	27
PID 368 wrote to memory of 760	368	TT COPY_002109.exe	27
PID 368 wrote to memory of 760	368	TT COPY_002109.exe	27
PID 368 wrote to memory of 760	368	TT COPY_002109.exe	27

C:\Users\Admin\AppData\Local\Temp\TT COPY_002109.exe
"C:\Users\Admin\AppData\Local\Temp\TT COPY_002109.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\TT COPY_002109.exe
  "C:\Users\Admin\AppData\Local\Temp\TT COPY_002109.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-59-0x0000000075C31000-0x0000000075C33000-memory.dmp

Download

memory/760-63-0x0000000000400000-0x00000000004A2000-memory.dmp