lokibot | cb5859f4d10039aef90fc7da30dcb696f3c0f0e917ea354ce8fa20f30ca20ed3

Analysis

max time kernel
129s
max time network
174s
platform
windows7_x64
resource
win7v20210408
submitted
23/09/2021, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b6c416ad0a3869fddacf695b1cf6570.exe
Size 926KB
Sample210923-p9tkjaeed9
SHA256 cb5859f4d10039aef90fc7da30dcb696f3c0f0e917ea354ce8fa20f30ca20ed3
MD5 8b6c416ad0a3869fddacf695b1cf6570
SHA1 5e96bf3db788b435c8daaf112f037d255664cc8d
SHA512 51b1dc5a394df175b9862b4f43fe9f414459f0510ce29ac40a296926452a8ac597d60761d7a91bb809e5a87298b97555ecd624ca1accbba0671d341ae3dddff1
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://silveryarmiler.sytes.net/ormanice/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	vbc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1276	8b6c416ad0a3869fddacf695b1cf6570.exe
1276	8b6c416ad0a3869fddacf695b1cf6570.exe
1276	8b6c416ad0a3869fddacf695b1cf6570.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1276	8b6c416ad0a3869fddacf695b1cf6570.exe
1276	8b6c416ad0a3869fddacf695b1cf6570.exe
1276	8b6c416ad0a3869fddacf695b1cf6570.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25
PID 1276 wrote to memory of 1308	1276	8b6c416ad0a3869fddacf695b1cf6570.exe	25

C:\Users\Admin\AppData\Local\Temp\8b6c416ad0a3869fddacf695b1cf6570.exe
"C:\Users\Admin\AppData\Local\Temp\8b6c416ad0a3869fddacf695b1cf6570.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Download

memory/1308-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1308-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads