lokibot | eac48bd4fd05338ee4fcc2c1865a06ddc1202efcefe7275f116f6fd65038e128

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe
Size 786KB
Sample240331-18fstseb66
SHA256 eac48bd4fd05338ee4fcc2c1865a06ddc1202efcefe7275f116f6fd65038e128
MD5 5fac89e432fa2d1a9b008483ab18f836
SHA1 4788aafcd6fb40f1682d4043c399ea4a54db66b4
SHA512 9ac3fea4c4fa60a00ae8ce305a9866e51650bf1f99d959da9473db13da88bb8e4406c52211207103441832b2bdc876ba665b6a7c30a8b3d7babf36d926cdf4e4
SSDEEP 12288:H0worZRjVcDDQwcQBnUPv5OjTXzw8CVITuREvqkxQWXQJixJ8nitW9kJ:7orZRjrm3XE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://136.243.159.53/~element/page.php?id=490
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
1668	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96
PID 2424 wrote to memory of 1668	2424	5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fac89e432fa2d1a9b008483ab18f836_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AddInProcess32.exe

Path C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
Size 42KB
SHA256 c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
MD5 9827ff3cdf4b83f9c86354606736ca9c
SHA1 e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA512 8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
SSDEEP 384:ac3JOvwWj8Gpw0A67dOpRipKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+TsPZX:a4JU8g17dG6Iq8XMnVYqW2Xmh829ukc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1668-15-0x0000000000500000-0x00000000005A2000-memory.dmp

Download

memory/2424-6-0x0000000005460000-0x000000000548C000-memory.dmp

Download

memory/2424-3-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/2424-4-0x0000000005020000-0x00000000050BC000-memory.dmp

Download

memory/2424-5-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/2424-0-0x00000000004E0000-0x00000000005AA000-memory.dmp

Download

memory/2424-7-0x0000000007980000-0x000000000798A000-memory.dmp

Download

memory/2424-8-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

memory/2424-9-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/2424-11-0x00000000063D0000-0x00000000063E2000-memory.dmp

Download

memory/2424-2-0x0000000005490000-0x0000000005A34000-memory.dmp

Download

memory/2424-1-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download

memory/2424-18-0x0000000075320000-0x0000000075AD0000-memory.dmp

Download