lokibot | b72b5ef75b3e64b3276b795c0a6e9afadca027db0038826d39f7a27d7242acd2

General

Target
invoice152214951409613.exe
Size 575KB
Sample200909-ydjj9jtmpa
SHA256 b72b5ef75b3e64b3276b795c0a6e9afadca027db0038826d39f7a27d7242acd2
MD5 a327bfdd8a9055113b639a64f53d4da6
SHA1 e958330ba78d18b66fd47bacf966ff69fab2a68c
SHA512 5e8315f478138838bdf2f4074efb22053149940560b0caa5d5d003be5178320072746accf9789ce2ee88d76017fb054cc009d6195d53ffd0343a22c002726b0d
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	invoice152214951409613.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	invoice152214951409613.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	invoice152214951409613.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	invoice152214951409613.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1164	1420	invoice152214951409613.exe	31

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1164	invoice152214951409613.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	invoice152214951409613.exe
Token: SeDebugPrivilege	1164	invoice152214951409613.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2016	1420	invoice152214951409613.exe	29
PID 1420 wrote to memory of 2016	1420	invoice152214951409613.exe	29
PID 1420 wrote to memory of 2016	1420	invoice152214951409613.exe	29
PID 1420 wrote to memory of 2016	1420	invoice152214951409613.exe	29
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31
PID 1420 wrote to memory of 1164	1420	invoice152214951409613.exe	31

C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe
"C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\exZlteS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6CF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1164