lokibot | f16756905639ab1d4670fc6eabd0e612aed2807b6e1fb660a412e80261ecd1b7

General

Target

Payment Confirmation for new August Invoice Order.exe
Size

623KB
MD5

1e43bf5f0effed9e3ff5d9732251e0d6
SHA1

d5444f6fc3c6670b8bc6b0e410004a2412b0012a
SHA256

f16756905639ab1d4670fc6eabd0e612aed2807b6e1fb660a412e80261ecd1b7
SHA512

a29cc40b59a2a1ebf9741e3eeefe9c098f22fe1545b6e10a88dd05b9e26cc83ac34b1d400b5f5ce91f55565610a188ea6544542ccee02ab29d91b908cf3323c9
SSDEEP

6144:5tT+iT+dyp1IzUk0dAfzN6AEjcaYw4qyDu+DMtHxOfhOCSsTiERgk2cpWYT+:5tBVpeEdCzN8wafYuM9SsTiO75

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://194.55.224.11/mathew/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 860 set thread context of 2992	860	Payment Confirmation for new August Invoice Order.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
860	Payment Confirmation for new August Invoice Order.exe
860	Payment Confirmation for new August Invoice Order.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	Payment Confirmation for new August Invoice Order.exe
Token: SeDebugPrivilege	2992	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30
PID 860 wrote to memory of 2992	860	Payment Confirmation for new August Invoice Order.exe	30

C:\Users\Admin\AppData\Local\Temp\Payment Confirmation for new August Invoice Order.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation for new August Invoice Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1024678951-1535676557-2778719785-1000\0f5007522459c86e95ffcc62f32308f1_e956bc1e-e1e1-4a80-9462-c2e2022bbe1a

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1024678951-1535676557-2778719785-1000\0f5007522459c86e95ffcc62f32308f1_e956bc1e-e1e1-4a80-9462-c2e2022bbe1a

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/860-54-0x0000000000130000-0x00000000001D0000-memory.dmp

Filesize
640KB

Download
memory/860-55-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/860-56-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/860-57-0x0000000000440000-0x0000000000456000-memory.dmp

Filesize
88KB

Download
memory/860-58-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/860-59-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/860-60-0x0000000004960000-0x00000000049BA000-memory.dmp

Filesize
360KB

Download
memory/860-70-0x0000000073DD0000-0x00000000744BE000-memory.dmp

Filesize
6.9MB

Download
memory/2992-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-90-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2992-99-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing