lokibot | 959d7b321afae31ebf810ede4fe1b19d5289128cf2255809ea9c30a71fb92fae

General

Target
28a17ccdd94d1898394d70dbd557ec70.exe
Size 233KB
Sample220411-jmh8dsfaa4
SHA256 959d7b321afae31ebf810ede4fe1b19d5289128cf2255809ea9c30a71fb92fae
MD5 28a17ccdd94d1898394d70dbd557ec70
SHA1 a2f996162fa6829b577ef6254660e34050ac595c
SHA512 becc8e93f71fd091daf4bd28be3568fc85575a7a355a369135c30777a709a350b7f75013dca08026138d52b62ca1df06265b87aa4f9ab478e74537743fbc201a
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1460	jeuwmbyzrh.exe
3108	jeuwmbyzrh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 3108	1460	jeuwmbyzrh.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
448	3108	WerFault.exe	82

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1460	540	28a17ccdd94d1898394d70dbd557ec70.exe	81
PID 540 wrote to memory of 1460	540	28a17ccdd94d1898394d70dbd557ec70.exe	81
PID 540 wrote to memory of 1460	540	28a17ccdd94d1898394d70dbd557ec70.exe	81
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82
PID 1460 wrote to memory of 3108	1460	jeuwmbyzrh.exe	82

C:\Users\Admin\AppData\Local\Temp\28a17ccdd94d1898394d70dbd557ec70.exe
"C:\Users\Admin\AppData\Local\Temp\28a17ccdd94d1898394d70dbd557ec70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
  C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
    C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
    3⤵
    - Executes dropped EXE
    PID:3108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 24
      4⤵
      Program crash
      PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3108 -ip 3108
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dnrmyqclc

Path C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
Size 5KB
SHA256 dcfd8a084f245354d7802b215f2d9861d19068d9ad3d985c9d9188cf812cabf7
MD5 1c77c785fb7e151bb2787e3cbbc48385
SHA1 72d98cfd4afde39181cd023d2845747c60a60acb
SHA512 57c812f696c9b56e6d539ba77a9b1014aabb4185138dd9fab42ff0abd4f5a626548eb186782c3b40d236d5e2f1358fe40f925c8b4603e1d7c1c8bff5b63a9eab
SSDEEP 96:kKECFtCQGEc2PfPi7+zVvxlyQTVZNNpEykZAfZCnmWkPdZ2LnPbbbdVkAL3hzrqV:uwpfPiSzA6PNNpEysAfAnmWkPdZ2LnPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

udw54t7t6g

Path C:\Users\Admin\AppData\Local\Temp\udw54t7t6g
Size 212KB
SHA256 c06dd9f1b9fae1a86d99a3834eea47d243bc225cbe892d7ac3b396ac4a89d064
MD5 955b1321618c222dece27dc6465aa698
SHA1 f3746c3f05d279d6933c99f2780226c8953914e3
SHA512 198d470cd589c2acddff1b6d562af7badfc3115884bccc4c0a2594a060de70ecd92f9c89307a7f3c7394e43ac79bb5953d1d0d6c029ea590269cba6ebfe44e86
SSDEEP 3072:r3+LZbj0ev1R/h2K5sfFyiduJIUeuEhwAyBMJrTpbEVOHZzazK5Bp6h:roZbjnbhE88om3wAK4rltHdazIB4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3108-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads