lokibot | b72b5ef75b3e64b3276b795c0a6e9afadca027db0038826d39f7a27d7242acd2

General

Target
invoice152214951409613.exe
Size 575KB
Sample200909-ydjj9jtmpa
SHA256 b72b5ef75b3e64b3276b795c0a6e9afadca027db0038826d39f7a27d7242acd2
MD5 a327bfdd8a9055113b639a64f53d4da6
SHA1 e958330ba78d18b66fd47bacf966ff69fab2a68c
SHA512 5e8315f478138838bdf2f4074efb22053149940560b0caa5d5d003be5178320072746accf9789ce2ee88d76017fb054cc009d6195d53ffd0343a22c002726b0d
MD5 SHA1 SHA512

Score

10^/10

evasion spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://195.69.140.147/.op/cr.php/b8ZlD3atg0TYU
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	invoice152214951409613.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	invoice152214951409613.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	invoice152214951409613.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	invoice152214951409613.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3412 set thread context of 3756	3412	invoice152214951409613.exe	79

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2980	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 2a017290b386d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3412	invoice152214951409613.exe
3412	invoice152214951409613.exe
3412	invoice152214951409613.exe
3412	invoice152214951409613.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3756	invoice152214951409613.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	svchost.exe
Token: SeCreatePagefilePrivilege	3036	svchost.exe
Token: SeDebugPrivilege	3412	invoice152214951409613.exe
Token: SeDebugPrivilege	3756	invoice152214951409613.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2980	3412	invoice152214951409613.exe	77
PID 3412 wrote to memory of 2980	3412	invoice152214951409613.exe	77
PID 3412 wrote to memory of 2980	3412	invoice152214951409613.exe	77
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79
PID 3412 wrote to memory of 3756	3412	invoice152214951409613.exe	79

C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe
"C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\exZlteS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9744.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\invoice152214951409613.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3036