lokibot | fdbff013b835081580756a378afeb8c6897a345f6934fa54d1c71ade4d15fe7f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/Blackface.dll
Size

49KB
MD5

526003df5801f2c386b4196a75aab900
SHA1

b1618e4963a5bf740be6844528ed864ea3d5314a
SHA256

fcddc27751bc3fd67e21582b51e246c880e2cda43efcef2618c6af0fed7ada92
SHA512

ae1fd0edb54acd712748bd983ac9863858dc6332424c6be477520eeca6261f320b3cdc56ab582a411cff0eb6ea2e9c23291e9693c9198767fd9f5a084288a371
SSDEEP

768:XHLwyqDCy1TMJ2MyTSUwKSCh/014+6JcqRwyHINcPl:XHoeZJ+XwKAqJXbHINcPl

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://joovy.ga/choolee/gate.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2932 rundll32.exe
2932 rundll32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exe

pid process

2932 rundll32.exe
2932 rundll32.exe

pid	process
2932	rundll32.exe
2932	rundll32.exe

pid	process
2932	rundll32.exe
2932	rundll32.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2188	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2188	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2188	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2188	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2188	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe
PID 2932 wrote to memory of 2032	2932	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Blackface.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\Blackface.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-3-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2032-5-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/2032-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2932-0-0x0000000074CB0000-0x0000000074D08000-memory.dmp

Filesize
352KB

Download
memory/2932-2-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2932-1-0x0000000075CB0000-0x0000000075CE5000-memory.dmp

Filesize
212KB

Download
memory/2932-6-0x0000000074CB0000-0x0000000074D08000-memory.dmp

Filesize
352KB

Download