lokibot | d31474e20a594d30c8f097e1eb883b8e84657ca84dcd202cfaf382fd0eff74af

General

Target
Rev-PO,Pdf.exe
Size 711KB
Sample200804-safeqsgvsj
SHA256 d31474e20a594d30c8f097e1eb883b8e84657ca84dcd202cfaf382fd0eff74af
MD5 b2a11b23837ab01144e1daa2e94ce5f0
SHA1 6e0c1e6d12aae3719e75fd813fa425c8cc621f5c
SHA512 f3c05735c445b76b94206c81d48965173b65aef7f5ae5d6f7e5ca74f0c86943da566d700842640f315d638467781b921c05df413686a113f4c3f9e8f290b36b3
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1128	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	Rev-PO,Pdf.exe
Token: SeDebugPrivilege	1516	Rev-PO,Pdf.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1128	1448	Rev-PO,Pdf.exe	24
PID 1448 wrote to memory of 1128	1448	Rev-PO,Pdf.exe	24
PID 1448 wrote to memory of 1128	1448	Rev-PO,Pdf.exe	24
PID 1448 wrote to memory of 1128	1448	Rev-PO,Pdf.exe	24
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26
PID 1448 wrote to memory of 1516	1448	Rev-PO,Pdf.exe	26

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1516	1448	Rev-PO,Pdf.exe	26

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1516	Rev-PO,Pdf.exe

C:\Users\Admin\AppData\Local\Temp\Rev-PO,Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Rev-PO,Pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPVmEq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEA5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\Rev-PO,Pdf.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: RenamesItself
  PID:1516