lokibot | a8414251412eeeb6df0c08ac3f2310e9bca5cd673918eed8b230a0c4304d9fd4

General

Target
78d40cece2b1c2ab6e5fea04199a624f.exe
Size 343KB
Sample211007-k4htmacdel
SHA256 a8414251412eeeb6df0c08ac3f2310e9bca5cd673918eed8b230a0c4304d9fd4
MD5 78d40cece2b1c2ab6e5fea04199a624f
SHA1 ec7e5c3dba89d12249b32a522a1b539963155ec9
SHA512 c422419a47b033307c85609b816adc628cf475c43e252c92d993524858de34a92f111e3a3855651015b0337c0746a1344c82e9ce3af9142aa2923bf7945763c8
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://checkvim.com/ga14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1476	78d40cece2b1c2ab6e5fea04199a624f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	78d40cece2b1c2ab6e5fea04199a624f.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27
PID 1740 wrote to memory of 1476	1740	78d40cece2b1c2ab6e5fea04199a624f.exe	27

C:\Users\Admin\AppData\Local\Temp\78d40cece2b1c2ab6e5fea04199a624f.exe
"C:\Users\Admin\AppData\Local\Temp\78d40cece2b1c2ab6e5fea04199a624f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\78d40cece2b1c2ab6e5fea04199a624f.exe
  "C:\Users\Admin\AppData\Local\Temp\78d40cece2b1c2ab6e5fea04199a624f.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1476-61-0x00000000765A1000-0x00000000765A3000-memory.dmp

Download

memory/1476-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1740-54-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/1740-56-0x00000000004D0000-0x00000000004DA000-memory.dmp

Download

memory/1740-57-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/1740-58-0x0000000000C10000-0x0000000000C4D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads