lokibot | 120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
Size

475KB
MD5

ef7dcebf0a73f49ded7f17ba4b3c1597
SHA1

e2f6a9664fe8b53e82932491a963f3b3a15dc8a1
SHA256

120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a
SHA512

79dd1d828effff5953d497405b009da0298215975aa2790eb9c9d2d519f9ff34cdb8b9f4634be82fd107b9b9bd9bce299334deba2e338cb0f2d78b9c044fcc23
SSDEEP

6144:8ApnvFMLzuP4RAu1icAp9/7ZxWgwxahXL92z2D8eYqzwcbL+6MyryXpZ+UnS1GKf:8kxwwJxWdahRg2ZHq6Myry1WQwLX

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://spencerstuartllc.top/evie2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-8-0x0000000000700000-0x00000000007A2000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-8-0x0000000000700000-0x00000000007A2000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-8-0x0000000000700000-0x00000000007A2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Suspicious use of SetThreadContext 1 IoCs

Processes:

120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe

description	pid	process	target process
PID 1880 set thread context of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe

description	pid	process	target process
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
PID 1880 wrote to memory of 2332	1880	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe	120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe

C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
"C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880

C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe
"C:\Users\Admin\AppData\Local\Temp\120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a.exe"
2⤵
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-0-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/1880-1-0x0000000000510000-0x000000000058E000-memory.dmp

Filesize
504KB

Download
memory/1880-2-0x0000000004F00000-0x0000000004F4E000-memory.dmp

Filesize
312KB

Download
memory/1880-3-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/1880-5-0x00000000051B0000-0x000000000524C000-memory.dmp

Filesize
624KB

Download
memory/1880-4-0x0000000005110000-0x00000000051A2000-memory.dmp

Filesize
584KB

Download
memory/1880-12-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1880-11-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/1880-6-0x0000000005000000-0x0000000005008000-memory.dmp

Filesize
32KB

Download
memory/2332-8-0x0000000000700000-0x00000000007A2000-memory.dmp

Filesize
648KB

Download