lokibot | b7cb60d089ef36aba7f0f58abd759a5c71f755f1b7842ce1f2acb11c4e192f0d

General

Target
Purchase Order # PO5292.exe
Size 424KB
Sample200703-2tec4ft9aj
SHA256 b7cb60d089ef36aba7f0f58abd759a5c71f755f1b7842ce1f2acb11c4e192f0d
MD5 893781a8fd8845fa8009b3ad10eb64c2
SHA1 b207c4bbcb1d41924f3792a076573273df259d2b
SHA512 143dc3eb6bab06117cf8b41159fccfe359892d50afa12756149247e4a5d5091f4083ea104465788b3ee5ef5875488ca2e022921bb8a8f237aca58667def26c59
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 240	900	Purchase Order # PO5292.exe	24
PID 900 wrote to memory of 240	900	Purchase Order # PO5292.exe	24
PID 900 wrote to memory of 240	900	Purchase Order # PO5292.exe	24
PID 900 wrote to memory of 240	900	Purchase Order # PO5292.exe	24
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26
PID 900 wrote to memory of 744	900	Purchase Order # PO5292.exe	26

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 744	900	Purchase Order # PO5292.exe	26

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	Purchase Order # PO5292.exe
Token: SeDebugPrivilege	744	Purchase Order # PO5292.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
900	Purchase Order # PO5292.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
744	Purchase Order # PO5292.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
240	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Purchase Order # PO5292.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order # PO5292.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yAEyOm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A94.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:240
- C:\Users\Admin\AppData\Local\Temp\Purchase Order # PO5292.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:744