lokibot | ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179

General

Target

ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
Size

145KB
MD5

a7cb109485d73f7adaf68652d04e254b
SHA1

e65ffdc9bcd87de5125aa22dc11c3b445e76f803
SHA256

ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179
SHA512

809e7bfb582065ef5936148b98ef8f72bf33badc634cc77ca9e5d9fadbdf6847794b1efd3fa4dc74fbff36e70287847a60fcc12eb22070ea370ada3c5c9eec83

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://cred0paper.com/tatah/display/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

description	pid	process	target process
PID 3284 set thread context of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

description pid process

Token: SeDebugPrivilege 3284 ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

description	pid	process
Token: SeDebugPrivilege	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

description	pid	process	target process
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
PID 3284 wrote to memory of 4528	3284	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe	ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe

C:\Users\Admin\AppData\Local\Temp\ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
"C:\Users\Admin\AppData\Local\Temp\ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284

C:\Users\Admin\AppData\Local\Temp\ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe
"C:\Users\Admin\AppData\Local\Temp\ac2c9b074e76788f9e8d1bfb0cfbf45a1c897331f5e1061dabc75a3ab1020179.exe"
2⤵
PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-130-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/3284-139-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/3284-140-0x0000000075130000-0x00000000756E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-131-0x0000000000000000-mapping.dmp

Download
memory/4528-132-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download
memory/4528-133-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download
memory/4528-134-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download
memory/4528-135-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing