lokibot | 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c

General

Target

recibo_de_copia_de_pago9884038.exe
Size

287KB
MD5

b64bad63393a769438902dcbbf5e5ced
SHA1

f9d21a97881ccab02a07fefd34afc2685f21e2b0
SHA256

4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c
SHA512

8014acf1022bdb56d95b1da5c189a53090c72123de48f11d5fce3954867a376837bb66f8d1b87e654793a354911a15b0e98a97a338ff6050884331d00552e7d6

Score

10^/10

persistence spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega3/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

recibo_de_copia_de_pago9884038.exerundll32.exe

description	pid	process	target process
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1412 wrote to memory of 1492	1412	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe
PID 1492 wrote to memory of 1596	1492	rundll32.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1492 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1492 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1492 rundll32.exe
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

2 1596 cmd.exe
3 1596 cmd.exe
4 1596 cmd.exe
7 1596 cmd.exe

pid	process
1492	rundll32.exe

pid	process
1492	rundll32.exe

pid	process
1492	rundll32.exe

flow	pid	process
2	1596	cmd.exe
3	1596	cmd.exe
4	1596	cmd.exe
7	1596	cmd.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

recibo_de_copia_de_pago9884038.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping	recibo_de_copia_de_pago9884038.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Tipping\lang	recibo_de_copia_de_pago9884038.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1596 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

description	pid	process
Token: SeDebugPrivilege	1596	cmd.exe

C:\Users\Admin\AppData\Local\Temp\recibo_de_copia_de_pago9884038.exe
"C:\Users\Admin\AppData\Local\Temp\recibo_de_copia_de_pago9884038.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Modifies service
PID:1412

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Barracoon,Hemlock
2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Barracoon.DLL

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bustee

Download Submit
\Users\Admin\AppData\Local\Temp\Barracoon.dll

Download Submit
memory/1412-0-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1492-3-0x0000000000000000-mapping.dmp

Download
memory/1596-7-0x0000000000000000-mapping.dmp

Download
memory/1596-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing