lokibot | ba70b16e63725d98406a9e9da5126d9dde77fea5f3b080b5571f2553675ad8a7

General

Target

Payment Date 10.07.2020.exe
Size

241KB
MD5

45e1487229334c83b43db67f3c9bcd34
SHA1

c303a612cfcdb6be2ff6c055d941e0358f33b9af
SHA256

ba70b16e63725d98406a9e9da5126d9dde77fea5f3b080b5571f2553675ad8a7
SHA512

43ae677459f09d072a41104c1771ab30d9b64b9516b0672c2ef9e225a1c6d9387bad25f6f5943020a43bb691d922f3da0e2da980b3d55d5e7fe7d983b401c2e1

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega2/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Loads dropped DLL 2 IoCs

Processes:

Payment Date 10.07.2020.exerundll32.exe

pid process

3136 Payment Date 10.07.2020.exe
640 rundll32.exe

pid	process
3136	Payment Date 10.07.2020.exe
640	rundll32.exe

Suspicious use of WriteProcessMemory 82 IoCs

Processes:

Payment Date 10.07.2020.exerundll32.exe

description	pid	process	target process
PID 3136 wrote to memory of 640	3136	Payment Date 10.07.2020.exe	rundll32.exe
PID 3136 wrote to memory of 640	3136	Payment Date 10.07.2020.exe	rundll32.exe
PID 3136 wrote to memory of 640	3136	Payment Date 10.07.2020.exe	rundll32.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe
PID 640 wrote to memory of 808	640	rundll32.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

640 rundll32.exe
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

640 rundll32.exe
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

5 808 cmd.exe
6 808 cmd.exe
7 808 cmd.exe
12 808 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 808 cmd.exe

pid	process
640	rundll32.exe

pid	process
640	rundll32.exe

flow	pid	process
5	808	cmd.exe
6	808	cmd.exe
7	808	cmd.exe
12	808	cmd.exe

description	pid	process
Token: SeDebugPrivilege	808	cmd.exe

Modifies registry class 2 IoCs

Processes:

Payment Date 10.07.2020.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent	Payment Date 10.07.2020.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\EditFlags = 00000100	Payment Date 10.07.2020.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Payment Date 10.07.2020.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Date 10.07.2020.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:3136

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe PetioleLaryngology,Michelle
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CapeOocyte

Download Submit
C:\Users\Admin\AppData\Local\Temp\PetioleLaryngology.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\PetioleLaryngology.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsv727D.tmp\UserInfo.dll

Download Submit
memory/640-1-0x0000000000000000-mapping.dmp

Download
memory/808-5-0x0000000000000000-mapping.dmp

Download
memory/808-6-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing