lokibot | 5866468d4084d09ee1b47f5135e8968923581b6f6fb5bacaed97b0e3da3a6999

General

Target

INV09072020PO400596.exe
Size

355KB
MD5

36c12aba9b24e41321b132896b3b0828
SHA1

2c5655f67cffbcdbf96afea40fca7dd9af445825
SHA256

5866468d4084d09ee1b47f5135e8968923581b6f6fb5bacaed97b0e3da3a6999
SHA512

58899ac35b6601e4901157fcb84e1d43500825372fe53b4defa29c2c91140965edd4bfc998aa3eea882a6dee5bd175044f166d4e27d66d1f5714b452e437e3d1

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega3/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

904 rundll32.exe
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

4 112 cmd.exe
5 112 cmd.exe
6 112 cmd.exe
9 112 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 112 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

pid	process
904	rundll32.exe

flow	pid	process
4	112	cmd.exe
5	112	cmd.exe
6	112	cmd.exe
9	112	cmd.exe

description	pid	process
Token: SeDebugPrivilege	112	cmd.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

INV09072020PO400596.exerundll32.exe

description	pid	process	target process
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 1552 wrote to memory of 904	1552	INV09072020PO400596.exe	rundll32.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe
PID 904 wrote to memory of 112	904	rundll32.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

904 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

904 rundll32.exe

pid	process
904	rundll32.exe

pid	process
904	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\INV09072020PO400596.exe
"C:\Users\Admin\AppData\Local\Temp\INV09072020PO400596.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe Senatorship,Ventricles
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Executrix

Download Submit
C:\Users\Admin\AppData\Local\Temp\Senatorship.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\Senatorship.dll

Download Submit
memory/112-4-0x0000000000000000-mapping.dmp

Download
memory/112-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/904-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing