lokibot | 7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe

General

Target
Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe
Size 422KB
Sample201209-mpxt1wp2l6
SHA256 7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe
MD5 3fcd90740d602891b8c2aa9fc2b62053
SHA1 3eb2f3a7163fce6b0f3442eb09a321cf6287a42b
SHA512 d7aab54ff7feb72786e2201eba88b296fca91fe63ce234a71163f79da40f0fa23a5fb9e6dd84ac99a39d01abc6a68ee7431870d548bb02b4f169ebb623f63733
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1320	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1320	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	29
PID 1756 wrote to memory of 1320	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	29
PID 1756 wrote to memory of 1320	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	29
PID 1756 wrote to memory of 1320	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	29
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31
PID 1756 wrote to memory of 1744	1756	Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe	31

C:\Users\Admin\AppData\Local\Temp\Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe
"C:\Users\Admin\AppData\Local\Temp\Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzfGNHV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB951.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1320
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1744