lokibot | ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5

General

Target

ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe
Size

321KB
MD5

211331400846c8e81625848c08cb9b7c
SHA1

82e7712d582d358cde56fe02998acb4c38222d5d
SHA256

ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5
SHA512

e9b5d5f299d20d03b37681c9ddc2ac92b5134a75852a04b021fde606626ac6848defd2f10cc692448c8049c3971bd9ee83c8cf4e3732414466b1b025660969c1

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://crestmart.ga/main/l09/sfmaro/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

4 1720 cmd.exe
5 1720 cmd.exe
6 1720 cmd.exe
7 1720 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1360 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1360 rundll32.exe
1360 rundll32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exe

pid process

1360 rundll32.exe
1360 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cmd.exe

description pid process

Token: SeDebugPrivilege 1720 cmd.exe

flow	pid	process
4	1720	cmd.exe
5	1720	cmd.exe
6	1720	cmd.exe
7	1720	cmd.exe

pid	process
1360	rundll32.exe

pid	process
1360	rundll32.exe
1360	rundll32.exe

pid	process
1360	rundll32.exe
1360	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1720	cmd.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exerundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 844 wrote to memory of 1360	844	ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe	rundll32.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe
PID 1360 wrote to memory of 1720	1360	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe
"C:\Users\Admin\AppData\Local\Temp\ca33728a22852c80a1894df0cd79f1a5b10c2085dbc4a9a8639d7942b2672cc5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe CoachPig,Excalibur
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Brash
MD5
7f730d8ab29f898a58f3e725054c4056

SHA1
16d7d59111b313302ac3d481ffd8f942b577791c

SHA256
465638b517c8fc66780c71226e56b22d1773d44bd626ea509c889fc154c08740

SHA512
272b8b65bda42f63b482b13bf7e1ec70b4079d743805e5db5ba389142fc236b5aba30a3e25070558dcac7b0ff23607fbc9fa0dc994179e13b45c77ccb87014f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CoachPig.DLL
MD5
0bf89fd2e99a592eed550e16dbeef9ba

SHA1
6b9394eaeb63891602e7ed48612c4e3d09d62a11

SHA256
791eded8cc07f2acf5fcae6b83bed733707df4b3cf5603287f982ef17c2a7229

SHA512
1a174d2e618df1af82cf0cb657879b49fc2df70c94eeb1af7bc8468bc0f33e1a3316011fc1240cde936d9c35222a31b4263aab4fc1dd57e486e9985f38e63d7a

Download Submit
\Users\Admin\AppData\Local\Temp\CoachPig.dll
MD5
0bf89fd2e99a592eed550e16dbeef9ba

SHA1
6b9394eaeb63891602e7ed48612c4e3d09d62a11

SHA256
791eded8cc07f2acf5fcae6b83bed733707df4b3cf5603287f982ef17c2a7229

SHA512
1a174d2e618df1af82cf0cb657879b49fc2df70c94eeb1af7bc8468bc0f33e1a3316011fc1240cde936d9c35222a31b4263aab4fc1dd57e486e9985f38e63d7a

Download Submit
memory/1360-0-0x0000000000000000-mapping.dmp

Download
memory/1360-4-0x0000000002960000-0x0000000002A02000-memory.dmp

Filesize
648KB

Download
memory/1644-7-0x000007FEF72D0000-0x000007FEF754A000-memory.dmp

Filesize
2.5MB

Download
memory/1720-5-0x0000000000000000-mapping.dmp

Download
memory/1720-6-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing