lokibot | 907b94712371352eba65c78fb8e4e99c68df75b2c0b9ce8a2a4ad91160df9f5e

Analysis

max time kernel
89s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
27/09/2021, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
781c03c9fe5134551a626abceb0a8526.exe
Size 249KB
Sample210927-kfas4sgbe4
SHA256 907b94712371352eba65c78fb8e4e99c68df75b2c0b9ce8a2a4ad91160df9f5e
MD5 781c03c9fe5134551a626abceb0a8526
SHA1 f61f0a5dddc5627c06ab1836364c917ca71476e6
SHA512 38a5f2ea854a86681211e6d9cf9e3c86c9046b7062b03a9ee013ce560e98890085f34471fcfc49c45b2e4990d17765e000ffa7aad2b17f785e213b93aed36360
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://136.243.159.53/~element/page.php?id=488
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
4648	781c03c9fe5134551a626abceb0a8526.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4680	781c03c9fe5134551a626abceb0a8526.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	781c03c9fe5134551a626abceb0a8526.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68
PID 4648 wrote to memory of 4680	4648	781c03c9fe5134551a626abceb0a8526.exe	68

C:\Users\Admin\AppData\Local\Temp\781c03c9fe5134551a626abceb0a8526.exe
"C:\Users\Admin\AppData\Local\Temp\781c03c9fe5134551a626abceb0a8526.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\781c03c9fe5134551a626abceb0a8526.exe
  "C:\Users\Admin\AppData\Local\Temp\781c03c9fe5134551a626abceb0a8526.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-115-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4680-117-0x0000000000400000-0x00000000004A2000-memory.dmp