lokibot | 3347f2ee195495a012ed7553481c88da56ff417f428598706c8d629dad11fe51

General

Target

tas0v3FvZSBpyH2.exe
Size

676KB
MD5

557353bdbd122177a75fe9b79e5b4242
SHA1

5815cf11845fb0eac0634fe7422b27f6f51163f5
SHA256

3347f2ee195495a012ed7553481c88da56ff417f428598706c8d629dad11fe51
SHA512

e7eb2ae7db03555fdf1c800305bc060fc07e6d9667910a9a022cc10f40e6d3edf901b7f4903799706b43566977e2e1f62e971109ffe84c9398f3f11beea10b74

Score

10^/10

lokibot coreentity rezer0 spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://skull3.ga/martins27/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1204-5-0x0000000000550000-0x0000000000553000-memory.dmp	coreentity

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1204-6-0x0000000004C30000-0x0000000004C52000-memory.dmp	rezer0

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

tas0v3FvZSBpyH2.exe

description pid process target process

PID 1204 set thread context of 1664 1204 tas0v3FvZSBpyH2.exe vbc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1688 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tas0v3FvZSBpyH2.exe

pid process

1204 tas0v3FvZSBpyH2.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tas0v3FvZSBpyH2.exevbc.exe

description pid process

Token: SeDebugPrivilege 1204 tas0v3FvZSBpyH2.exe
Token: SeDebugPrivilege 1664 vbc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tas0v3FvZSBpyH2.exe

pid process

1204 tas0v3FvZSBpyH2.exe
1204 tas0v3FvZSBpyH2.exe

description	pid	process	target process
PID 1204 set thread context of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe

pid	process
1688	schtasks.exe

pid	process
1204	tas0v3FvZSBpyH2.exe

description	pid	process
Token: SeDebugPrivilege	1204	tas0v3FvZSBpyH2.exe
Token: SeDebugPrivilege	1664	vbc.exe

pid	process
1204	tas0v3FvZSBpyH2.exe
1204	tas0v3FvZSBpyH2.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

tas0v3FvZSBpyH2.exe

description	pid	process	target process
PID 1204 wrote to memory of 1688	1204	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1204 wrote to memory of 1688	1204	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1204 wrote to memory of 1688	1204	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1204 wrote to memory of 1688	1204	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1204 wrote to memory of 1664	1204	tas0v3FvZSBpyH2.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\tas0v3FvZSBpyH2.exe
"C:\Users\Admin\AppData\Local\Temp\tas0v3FvZSBpyH2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TCGVLxd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp"
2⤵
- Creates scheduled task(s)
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp
MD5
aba34a75e51281c82b589410284053c9

SHA1
430ae9586717ebdbbf52b125ee12d2d34daea674

SHA256
f287b771bbe59f92c36161ad145a92de0263abbea42ae21141688b36daca6d43

SHA512
68ee106569b071cb6b30040f4e241edfbcc8730d5994596f45c23d0ff4e536ac7c6332d67b5be57bea95fcfe68dbd1fd640b74ecd0af3cd48a3e845ccee53df7

Download Submit
memory/1096-4-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp

Filesize
2.5MB

Download
memory/1204-0-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/1204-1-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1204-3-0x0000000000690000-0x00000000006B4000-memory.dmp

Filesize
144KB

Download
memory/1204-5-0x0000000000550000-0x0000000000553000-memory.dmp

Filesize
12KB

Download
memory/1204-6-0x0000000004C30000-0x0000000004C52000-memory.dmp

Filesize
136KB

Download
memory/1664-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1664-10-0x00000000004139DE-mapping.dmp

Download
memory/1664-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1688-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads