lokibot | 32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d

General

Target

32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe
Size

298KB
MD5

cf84bcaee07c71ce84e017806ceb559a
SHA1

6c67c7f67d30edb25720f3742f6e9ae29a9b8589
SHA256

32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d
SHA512

a83e620875d5532f4c899bd4ef6f6dcb1d135c4e7d47aec641f7f26325a662164417188c1803cd01f7eac6be81fcd74cebf90813aa9028e1026b606677c5fb6e

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega2/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

7 1460 cmd.exe
8 1460 cmd.exe
9 1460 cmd.exe
13 1460 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1460 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Loads dropped DLL 2 IoCs

Processes:

32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exerundll32.exe

pid process

2040 32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe
1172 rundll32.exe

flow	pid	process
7	1460	cmd.exe
8	1460	cmd.exe
9	1460	cmd.exe
13	1460	cmd.exe

description	pid	process
Token: SeDebugPrivilege	1460	cmd.exe

pid	process
2040	32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe
1172	rundll32.exe

Suspicious use of WriteProcessMemory 82 IoCs

Processes:

32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1172	2040	32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe	rundll32.exe
PID 2040 wrote to memory of 1172	2040	32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe	rundll32.exe
PID 2040 wrote to memory of 1172	2040	32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe	rundll32.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe
PID 1172 wrote to memory of 1460	1172	rundll32.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1172 rundll32.exe

pid	process
1172	rundll32.exe

pid	process
1172	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe
"C:\Users\Admin\AppData\Local\Temp\32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe WootzRodeo,Epimers
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Surrogate

Download Submit
C:\Users\Admin\AppData\Local\Temp\WootzRodeo.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\WootzRodeo.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsgFF9A.tmp\System.dll

Download Submit
memory/1172-1-0x0000000000000000-mapping.dmp

Download
memory/1460-5-0x0000000000000000-mapping.dmp

Download
memory/1460-6-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing