lokibot | ba70b16e63725d98406a9e9da5126d9dde77fea5f3b080b5571f2553675ad8a7

General

Target

Payment Date 10.07.2020.exe
Size

241KB
MD5

45e1487229334c83b43db67f3c9bcd34
SHA1

c303a612cfcdb6be2ff6c055d941e0358f33b9af
SHA256

ba70b16e63725d98406a9e9da5126d9dde77fea5f3b080b5571f2553675ad8a7
SHA512

43ae677459f09d072a41104c1771ab30d9b64b9516b0672c2ef9e225a1c6d9387bad25f6f5943020a43bb691d922f3da0e2da980b3d55d5e7fe7d983b401c2e1

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega2/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Loads dropped DLL 2 IoCs

Processes:

Payment Date 10.07.2020.exerundll32.exe

pid process

1104 Payment Date 10.07.2020.exe
836 rundll32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exe

pid process

836 rundll32.exe
836 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1420 cmd.exe

pid	process
1104	Payment Date 10.07.2020.exe
836	rundll32.exe

pid	process
836	rundll32.exe
836	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1420	cmd.exe

Modifies registry class 2 IoCs

Processes:

Payment Date 10.07.2020.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent	Payment Date 10.07.2020.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\EditFlags = 00000100	Payment Date 10.07.2020.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

Payment Date 10.07.2020.exerundll32.exe

description	pid	process	target process
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 1104 wrote to memory of 836	1104	Payment Date 10.07.2020.exe	rundll32.exe
PID 836 wrote to memory of 1408	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1408	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1408	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1408	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1408	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe
PID 836 wrote to memory of 1420	836	rundll32.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

836 rundll32.exe
836 rundll32.exe
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

2 1420 cmd.exe
3 1420 cmd.exe
4 1420 cmd.exe
7 1420 cmd.exe

pid	process
836	rundll32.exe
836	rundll32.exe

flow	pid	process
2	1420	cmd.exe
3	1420	cmd.exe
4	1420	cmd.exe
7	1420	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Payment Date 10.07.2020.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Date 10.07.2020.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe PetioleLaryngology,Michelle
2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
PID:1420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CapeOocyte

Download Submit
C:\Users\Admin\AppData\Local\Temp\PetioleLaryngology.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\PetioleLaryngology.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsqFAD4.tmp\UserInfo.dll

Download Submit
memory/836-1-0x0000000000000000-mapping.dmp

Download
memory/1420-5-0x0000000000000000-mapping.dmp

Download
memory/1420-6-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing