lokibot | 5d9004bb38a2e4c6ee1528f75e8453e778d9f39a3e7d9f02ee7821eae65cf886

General

Target

win32.exe
Size

264KB
MD5

aee8a4f7de7a199cc9a7d5cfbc3e11d9
SHA1

cd6c91aa00c6cf69573fb156198b6afb44a5a6e6
SHA256

5d9004bb38a2e4c6ee1528f75e8453e778d9f39a3e7d9f02ee7821eae65cf886
SHA512

7fefe7d493b1fc2a51db5d1e53fc0b59629f0aa982169a87378d0880d10dc051f337a0d3fb2cefb73a6a546d8910c189aa5cdd9539489db22c34e68f7b0c972e

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://joovy.ga/webxpo/gate.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Blacklisted process makes network request 7 IoCs

Processes:

cmd.exe

flow pid process

5 1792 cmd.exe
6 1792 cmd.exe
7 1792 cmd.exe
11 1792 cmd.exe
13 1792 cmd.exe
14 1792 cmd.exe
15 1792 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1832 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1832 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1832 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1792 cmd.exe

flow	pid	process
5	1792	cmd.exe
6	1792	cmd.exe
7	1792	cmd.exe
11	1792	cmd.exe
13	1792	cmd.exe
14	1792	cmd.exe
15	1792	cmd.exe

pid	process
1832	rundll32.exe

pid	process
1832	rundll32.exe

pid	process
1832	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1792	cmd.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

win32.exerundll32.exe

description	pid	process	target process
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1080 wrote to memory of 1832	1080	win32.exe	rundll32.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe
PID 1832 wrote to memory of 1792	1832	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe
"C:\Users\Admin\AppData\Local\Temp\win32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe KakaGemot,Hurley
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Emphysema

Download Submit
C:\Users\Admin\AppData\Local\Temp\KakaGemot.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\KakaGemot.dll

Download Submit
memory/1792-5-0x0000000000000000-mapping.dmp

Download
memory/1792-6-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1832-0-0x0000000000000000-mapping.dmp

Download
memory/1832-4-0x0000000000330000-0x00000000003D2000-memory.dmp

Filesize
648KB

Download
memory/1892-7-0x000007FEF7920000-0x000007FEF7B9A000-memory.dmp

Filesize
2.5MB

Download

Resubmissions

Analysis

Sharing