lokibot | 3347f2ee195495a012ed7553481c88da56ff417f428598706c8d629dad11fe51

General

Target

tas0v3FvZSBpyH2.exe
Size

676KB
MD5

557353bdbd122177a75fe9b79e5b4242
SHA1

5815cf11845fb0eac0634fe7422b27f6f51163f5
SHA256

3347f2ee195495a012ed7553481c88da56ff417f428598706c8d629dad11fe51
SHA512

e7eb2ae7db03555fdf1c800305bc060fc07e6d9667910a9a022cc10f40e6d3edf901b7f4903799706b43566977e2e1f62e971109ffe84c9398f3f11beea10b74

Score

10^/10

lokibot coreentity rezer0 spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://skull3.ga/martins27/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral2/memory/1108-7-0x00000000013A0000-0x00000000013A3000-memory.dmp	coreentity

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/1108-8-0x000000000B080000-0x000000000B0A2000-memory.dmp	rezer0

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

tas0v3FvZSBpyH2.exe

description pid process target process

PID 1108 set thread context of 2656 1108 tas0v3FvZSBpyH2.exe vbc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3736 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tas0v3FvZSBpyH2.exe

pid process

1108 tas0v3FvZSBpyH2.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tas0v3FvZSBpyH2.exevbc.exe

description pid process

Token: SeDebugPrivilege 1108 tas0v3FvZSBpyH2.exe
Token: SeDebugPrivilege 2656 vbc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tas0v3FvZSBpyH2.exe

pid process

1108 tas0v3FvZSBpyH2.exe
1108 tas0v3FvZSBpyH2.exe

description	pid	process	target process
PID 1108 set thread context of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe

pid	process
3736	schtasks.exe

pid	process
1108	tas0v3FvZSBpyH2.exe

description	pid	process
Token: SeDebugPrivilege	1108	tas0v3FvZSBpyH2.exe
Token: SeDebugPrivilege	2656	vbc.exe

pid	process
1108	tas0v3FvZSBpyH2.exe
1108	tas0v3FvZSBpyH2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tas0v3FvZSBpyH2.exe

description	pid	process	target process
PID 1108 wrote to memory of 3736	1108	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1108 wrote to memory of 3736	1108	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1108 wrote to memory of 3736	1108	tas0v3FvZSBpyH2.exe	schtasks.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe
PID 1108 wrote to memory of 2656	1108	tas0v3FvZSBpyH2.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\tas0v3FvZSBpyH2.exe
"C:\Users\Admin\AppData\Local\Temp\tas0v3FvZSBpyH2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TCGVLxd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp"
2⤵
- Creates scheduled task(s)
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp
MD5
5372425f0b6d366851132af60b9ceb25

SHA1
1ec1bd5ab2c53feb4e2fb1ba5f8428c2453c4281

SHA256
e852277d9136c1fc698a925097ba294cea35d5cf2834555c2c52afc1f2514bb3

SHA512
ab21b81d3afeb1de40a19d868ed80b7885693e091d36916f534cccb0109935fb1f984ea8a5ec8a275ddc8f5758dc01db8d38982ea1f10cf3136ee1365502ef4e

Download Submit
memory/1108-7-0x00000000013A0000-0x00000000013A3000-memory.dmp

Filesize
12KB

Download
memory/1108-3-0x00000000052B0000-0x00000000052D4000-memory.dmp

Filesize
144KB

Download
memory/1108-4-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/1108-5-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/1108-6-0x0000000007850000-0x0000000007851000-memory.dmp

Filesize
4KB

Download
memory/1108-0-0x0000000073A70000-0x000000007415E000-memory.dmp

Filesize
6.9MB

Download
memory/1108-8-0x000000000B080000-0x000000000B0A2000-memory.dmp

Filesize
136KB

Download
memory/1108-9-0x000000000B150000-0x000000000B151000-memory.dmp

Filesize
4KB

Download
memory/1108-1-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/2656-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2656-13-0x00000000004139DE-mapping.dmp

Download
memory/2656-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3736-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads