lokibot | e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117

General

Target
e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe
Size 557KB
Sample200709-18bbxe8nna
SHA256 e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117
MD5 fc5cd5a5634e0278a26c917a4d35e6cb
SHA1 947a2b235f0931d7dbae5ae7e191787e206f7628
SHA512 feb93650e811bf601f33850a0def95b436ce1677172e3a257492e28159506b7ee7c586a42c1ad8d37555ec6ac2371fd12c451732a16fbb9c403af5e0ad3201f5
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://emirate-net.me/ig1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe
Token: SeDebugPrivilege	1692	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 896 set thread context of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1692	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1052	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1052	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	24
PID 896 wrote to memory of 1052	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	24
PID 896 wrote to memory of 1052	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	24
PID 896 wrote to memory of 1052	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	24
PID 896 wrote to memory of 1664	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	26
PID 896 wrote to memory of 1664	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	26
PID 896 wrote to memory of 1664	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	26
PID 896 wrote to memory of 1664	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	26
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27
PID 896 wrote to memory of 1692	896	e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe	27

C:\Users\Admin\AppData\Local\Temp\e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe
"C:\Users\Admin\AppData\Local\Temp\e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\plDuXdr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF39.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe
  "{path}"
  2⤵
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:1692