lokibot | e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8

General

Target

PO-USD#04072018.exe
Size

209KB
MD5

9d99b9aff2251ca3b2ab0658ab1ec0a6
SHA1

b2e8a3ced8d1a4ef15432892ed2998920d4b7cd0
SHA256

e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8
SHA512

0d7fbfd5d3c72cd5557afcfcf805a650dcd14af308360f2bb18220276d632647baadb3c7752fef8dea79ba6bed7a951a9dc3ec358f1bc25a2beed6c416f432d0

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://egamcorps.ga/~zadmin/lmark/pvent/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

PO-USD#04072018.exerundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1100 wrote to memory of 1296	1100	PO-USD#04072018.exe	rundll32.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe
PID 1296 wrote to memory of 1316	1296	rundll32.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1296 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1296 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1296 rundll32.exe
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

2 1316 cmd.exe
3 1316 cmd.exe
4 1316 cmd.exe
7 1316 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1316 cmd.exe

pid	process
1296	rundll32.exe

pid	process
1296	rundll32.exe

pid	process
1296	rundll32.exe

flow	pid	process
2	1316	cmd.exe
3	1316	cmd.exe
4	1316	cmd.exe
7	1316	cmd.exe

description	pid	process
Token: SeDebugPrivilege	1316	cmd.exe

C:\Users\Admin\AppData\Local\Temp\PO-USD#04072018.exe
"C:\Users\Admin\AppData\Local\Temp\PO-USD#04072018.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Fireside,Pretor
2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fireside.DLL

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mantel

Download Submit
\Users\Admin\AppData\Local\Temp\Fireside.dll

Download Submit
memory/1296-0-0x0000000000000000-mapping.dmp

Download
memory/1316-4-0x0000000000000000-mapping.dmp

Download
memory/1316-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing