lokibot | b3df56321b7da5c5bbf1836d3d51a81840becd610d435f4b799b7565863329d1

General

Target
A849501A283107E8E0530A0087605A42.pdf.exe
Size 519KB
Sample200715-p4y25hlc76
SHA256 b3df56321b7da5c5bbf1836d3d51a81840becd610d435f4b799b7565863329d1
MD5 86817b85beda2a2c4e3dd6871b90bc31
SHA1 8a0b1623637b60ecbd1bfdfcb66805e6be293ef5
SHA512 d7ea8a79a49c2d2ce35ae91581b0c149b78186dc7cabc0b2e018ce8a9c8a11b34bc70c0493ebd0e069936abf0a073a4a717c9fa8b8517123eb72e5fcca772e1c
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
572	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 572	2944	A849501A283107E8E0530A0087605A42.pdf.exe	67
PID 2944 wrote to memory of 572	2944	A849501A283107E8E0530A0087605A42.pdf.exe	67
PID 2944 wrote to memory of 572	2944	A849501A283107E8E0530A0087605A42.pdf.exe	67
PID 2944 wrote to memory of 2952	2944	A849501A283107E8E0530A0087605A42.pdf.exe	69
PID 2944 wrote to memory of 2952	2944	A849501A283107E8E0530A0087605A42.pdf.exe	69
PID 2944 wrote to memory of 2952	2944	A849501A283107E8E0530A0087605A42.pdf.exe	69
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70
PID 2944 wrote to memory of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	A849501A283107E8E0530A0087605A42.pdf.exe
Token: SeDebugPrivilege	3732	A849501A283107E8E0530A0087605A42.pdf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	A849501A283107E8E0530A0087605A42.pdf.exe
2944	A849501A283107E8E0530A0087605A42.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 3732	2944	A849501A283107E8E0530A0087605A42.pdf.exe	70

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3732	A849501A283107E8E0530A0087605A42.pdf.exe

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

C:\Users\Admin\AppData\Local\Temp\A849501A283107E8E0530A0087605A42.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\A849501A283107E8E0530A0087605A42.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2944
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBXYPCNCRLhrHx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6F3F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:572
- C:\Users\Admin\AppData\Local\Temp\A849501A283107E8E0530A0087605A42.pdf.exe
  "{path}"
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\A849501A283107E8E0530A0087605A42.pdf.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:3732