lokibot | 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c

General

Target

recibo_de_copia_de_pago9884038.exe
Size

287KB
MD5

b64bad63393a769438902dcbbf5e5ced
SHA1

f9d21a97881ccab02a07fefd34afc2685f21e2b0
SHA256

4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c
SHA512

8014acf1022bdb56d95b1da5c189a53090c72123de48f11d5fce3954867a376837bb66f8d1b87e654793a354911a15b0e98a97a338ff6050884331d00552e7d6

Score

10^/10

persistence spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega3/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

5 640 cmd.exe
6 640 cmd.exe
8 640 cmd.exe
11 640 cmd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

428 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

428 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 640 cmd.exe

flow	pid	process
5	640	cmd.exe
6	640	cmd.exe
8	640	cmd.exe
11	640	cmd.exe

pid	process
428	rundll32.exe

pid	process
428	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	640	cmd.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

recibo_de_copia_de_pago9884038.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping	recibo_de_copia_de_pago9884038.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping\lang	recibo_de_copia_de_pago9884038.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 82 IoCs

Processes:

recibo_de_copia_de_pago9884038.exerundll32.exe

description	pid	process	target process
PID 2536 wrote to memory of 428	2536	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 2536 wrote to memory of 428	2536	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 2536 wrote to memory of 428	2536	recibo_de_copia_de_pago9884038.exe	rundll32.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe
PID 428 wrote to memory of 640	428	rundll32.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

428 rundll32.exe

pid	process
428	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\recibo_de_copia_de_pago9884038.exe
"C:\Users\Admin\AppData\Local\Temp\recibo_de_copia_de_pago9884038.exe"
1⤵
- Modifies service
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Barracoon,Hemlock
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Barracoon.DLL

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bustee

Download Submit
\Users\Admin\AppData\Local\Temp\Barracoon.dll

Download Submit
memory/428-0-0x0000000000000000-mapping.dmp

Download
memory/640-4-0x0000000000000000-mapping.dmp

Download
memory/640-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing