lokibot | 135ecfd293ccd2b23f29fe2caa223df6d827ec6a11669608361e61ccee2b99e9

General

Target
327472a0c08de24a8d8f4063ddf166b2.exe
Size 445KB
Sample210922-j15csacaa3
SHA256 135ecfd293ccd2b23f29fe2caa223df6d827ec6a11669608361e61ccee2b99e9
MD5 327472a0c08de24a8d8f4063ddf166b2
SHA1 69947c9d43a38505b1b7f3ceee5ac6a0c863a361
SHA512 68946ce0b23ed073fa79e9a23a4e4ba719ec99128cd7b0fed102c3f305c47b65c46c3b1e15877296a01f6da7dc18c5258bfe22143418790eb22eb741d099c49b
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://checkvim.com/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	327472a0c08de24a8d8f4063ddf166b2.exe
3628	327472a0c08de24a8d8f4063ddf166b2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3496	327472a0c08de24a8d8f4063ddf166b2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	327472a0c08de24a8d8f4063ddf166b2.exe
Token: SeDebugPrivilege	3496	327472a0c08de24a8d8f4063ddf166b2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3008	3628	327472a0c08de24a8d8f4063ddf166b2.exe	68
PID 3628 wrote to memory of 3008	3628	327472a0c08de24a8d8f4063ddf166b2.exe	68
PID 3628 wrote to memory of 3008	3628	327472a0c08de24a8d8f4063ddf166b2.exe	68
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69
PID 3628 wrote to memory of 3496	3628	327472a0c08de24a8d8f4063ddf166b2.exe	69

C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe
"C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe
  "C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe"
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe
  "C:\Users\Admin\AppData\Local\Temp\327472a0c08de24a8d8f4063ddf166b2.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3496-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3496-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3628-114-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/3628-116-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/3628-117-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/3628-118-0x00000000049E0000-0x0000000004A72000-memory.dmp

Download

memory/3628-119-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/3628-120-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/3628-121-0x0000000004CD0000-0x0000000004CED000-memory.dmp

Download

memory/3628-122-0x00000000058F0000-0x000000000593D000-memory.dmp

Download

memory/3628-123-0x00000000056E0000-0x00000000056FD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads