lokibot | cb39e6d0e8f98ce1d2ea3be9b320ba32c804d5c428c9057c3dda39533536194c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
Size

395KB
MD5

69cdd4b211022ff4c6f152673ae9a187
SHA1

4a0e7e2b4ea24c15fb3a7fb9d474bc95174caa55
SHA256

cb39e6d0e8f98ce1d2ea3be9b320ba32c804d5c428c9057c3dda39533536194c
SHA512

09bb34a2be36c1834edc1e2d03b6d4a7f25fee39e449ddcada6966a5aed56e1ed31c11c42163ad6f25c88b6333deb86e19ce799027e14ca38d8ad1f0d52b015e
SSDEEP

6144:RsmDsQwJM5tUebn2BUgKj1LbWTcX8Jz1CjPKliegZSkY1bVJPijmiaPJRuIhpx:+ML3iLKgcXQzcTKl0atL6jBajJhpx

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://mclhk-net.com/chanelstv/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 208 set thread context of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94
PID 208 wrote to memory of 3756	208	69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118.exe"
  2⤵
  PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-0-0x0000000074A02000-0x0000000074A03000-memory.dmp

Filesize
4KB

Download
memory/208-1-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/208-2-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/208-3-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/208-4-0x0000000074A02000-0x0000000074A03000-memory.dmp

Filesize
4KB

Download
memory/208-5-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/208-14-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3756-7-0x0000000000570000-0x0000000000612000-memory.dmp

Filesize
648KB

Download