lokibot | 62ac89587b0a9c266afa73fda6547bdf3cf814c93ea7bd35d92db98e1bbb9880

General

Target
Shipment Document BL,INV and Packing list Attached.PDF.exe
Size 318KB
Sample200702-hr97dxl7qa
SHA256 62ac89587b0a9c266afa73fda6547bdf3cf814c93ea7bd35d92db98e1bbb9880
MD5 1810fa6e12ca75e1b8e476c95b509028
SHA1 36b98bddf1f04c127bb9d2f7c6c4c1e815f9fdbe
SHA512 3edaa5ac589565ec6e3eb14e9012dd3154c590bd23355d7274e145ad9ad757562c11afc0bab1f22e4dba57c89572cdc21dbbcbc32a193cd052141c62f27f59cb
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2220	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	72
PID 3848 wrote to memory of 2220	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	72
PID 3848 wrote to memory of 2220	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	72
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74
PID 3848 wrote to memory of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 2872	3848	Shipment Document BL,INV and Packing list Attached.PDF.exe	74

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	Shipment Document BL,INV and Packing list Attached.PDF.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2872	Shipment Document BL,INV and Packing list Attached.PDF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2220	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3848
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\shuAqZXym" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8747.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and Packing list Attached.PDF.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:2872