lokibot | aa870e1218a74e244dbe047277a2037c22c4460cb5ebfc5d12267950121bad6f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/Moustache.dll
Size

41KB
MD5

5e68491fc9296f4067d397093f25e8f4
SHA1

0447a8247227fc3a12c7b9cd24cf5717f6ea8ec0
SHA256

47b284c8cea5f056b17bed41e272d0d61d70a169d3366a53104435bb393c1e89
SHA512

4a4d6f5c81f0f161e4d70fe221192f665084e1625ba35aa052a81c6c06c706d29c920066289b948998fecd8863d799f3d33be5f850e416d47bf6be0683215b7e
SSDEEP

768:3wmqf3FVwBf7uQpwukQRhsOaGnTEDE3vyS12wfpVDt4t:3wFTwBju3LQvNSS1rfpTw

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://remzclot.ga/etc/main/l09/harl/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2816 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2816 rundll32.exe

pid	process
2816	rundll32.exe

pid	process
2816	rundll32.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 2816	2596	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe
PID 2816 wrote to memory of 2140	2816	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Moustache.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Moustache.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:2140

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2140-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2140-5-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/2816-0-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2816-1-0x0000000075010000-0x0000000075068000-memory.dmp

Filesize
352KB

Download
memory/2816-2-0x00000000758C0000-0x00000000758F5000-memory.dmp

Filesize
212KB

Download
memory/2816-6-0x0000000075010000-0x0000000075068000-memory.dmp

Filesize
352KB

Download