lokibot | 31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

Analysis

max time kernel
29s
max time network
26s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1221.exe
Size

789KB
MD5

10dec51d466fde5077a06dbbedcbfad7
SHA1

a667d6c1aca853f5eda2763fc982a0ecc6d801db
SHA256

da0d1f2e79659c06cb55a3d6b11f9e3ae9af3ce7de9df26049ff9a8e78ec4e29
SHA512

79a1883e71afdc251f344047a830a3bbb71321dd8a5d1f9989a56b425b85887195669abe33e426d18eca3f6f7cff0f9aa44c666b437b116bcfd58cad610d31da
SSDEEP

12288:keSNcgbb1Ku4XYxqSSFFYrh1Zxn7FrY4f38S33ueK4gZfj7J:kVXqYQKLZp9F339RgZ7F

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://botnet.americaircairmakan.com/ace8/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

1221.exe

description pid process target process

PID 3060 set thread context of 2580 3060 1221.exe 1221.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1221.exe

pid process

3060 1221.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

1221.exe

pid process

3060 1221.exe
3060 1221.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1221.exe

pid process

2580 1221.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1221.exe

description pid process

Token: SeDebugPrivilege 2580 1221.exe

description	pid	process	target process
PID 3060 set thread context of 2580	3060	1221.exe	1221.exe

pid	process
3060	1221.exe

pid	process
3060	1221.exe
3060	1221.exe

pid	process
2580	1221.exe

description	pid	process
Token: SeDebugPrivilege	2580	1221.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1221.exe

description	pid	process	target process
PID 3060 wrote to memory of 2580	3060	1221.exe	1221.exe
PID 3060 wrote to memory of 2580	3060	1221.exe	1221.exe
PID 3060 wrote to memory of 2580	3060	1221.exe	1221.exe
PID 3060 wrote to memory of 2580	3060	1221.exe	1221.exe

C:\Users\Admin\AppData\Local\Temp\1221.exe
"C:\Users\Admin\AppData\Local\Temp\1221.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\1221.exe
"C:\Users\Admin\AppData\Local\Temp\1221.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4219371764-2579186923-3390623117-1000\0f5007522459c86e95ffcc62f32308f1_a858d4fe-e318-4442-a90a-f02c78216cd3
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4219371764-2579186923-3390623117-1000\0f5007522459c86e95ffcc62f32308f1_a858d4fe-e318-4442-a90a-f02c78216cd3
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/2580-56-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2580-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2580-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2580-102-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3060-53-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/3060-54-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3060-55-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3060-57-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download