lokibot | c75e2b1752bd8221bd68fea21243915af2a92834a23d148a46e41b370badfd18

General

Target
PO_60577.scr
Size 1.1MB
Sample210113-rb74cfjf72
SHA256 c75e2b1752bd8221bd68fea21243915af2a92834a23d148a46e41b370badfd18
MD5 000af790102eb884cfb98b2e4cf50d5a
SHA1 aaa6182f2db7d3608e131f5badf612c7e4ab3377
SHA512 3693c63e07eb23185a7bf8d64a25f4128e13e20441827319db6f3f6a320f6472ba494b60cb69be8c5fbb7c634d0af90c671248632df852408faf5d76b10d72c7
MD5 SHA1 SHA512

Score

10^/10

lokibot persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.206.215.56/r-1/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1580	explore.exe
344	AddInProcess32.exe

Loads dropped DLL 2 IoCs

pid	Process
848	PO_60577.scr
1580	explore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\explore = "C:\\Users\\Admin\\explore.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 344	1580	explore.exe	33

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
848	PO_60577.scr
848	PO_60577.scr
848	PO_60577.scr
848	PO_60577.scr
848	PO_60577.scr
1580	explore.exe
1580	explore.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	PO_60577.scr
Token: SeDebugPrivilege	1580	explore.exe
Token: SeDebugPrivilege	344	AddInProcess32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1500	848	PO_60577.scr	26
PID 848 wrote to memory of 1500	848	PO_60577.scr	26
PID 848 wrote to memory of 1500	848	PO_60577.scr	26
PID 848 wrote to memory of 1500	848	PO_60577.scr	26
PID 1500 wrote to memory of 1412	1500	cmd.exe	28
PID 1500 wrote to memory of 1412	1500	cmd.exe	28
PID 1500 wrote to memory of 1412	1500	cmd.exe	28
PID 1500 wrote to memory of 1412	1500	cmd.exe	28
PID 848 wrote to memory of 1580	848	PO_60577.scr	32
PID 848 wrote to memory of 1580	848	PO_60577.scr	32
PID 848 wrote to memory of 1580	848	PO_60577.scr	32
PID 848 wrote to memory of 1580	848	PO_60577.scr	32
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33
PID 1580 wrote to memory of 344	1580	explore.exe	33

C:\Users\Admin\AppData\Local\Temp\PO_60577.scr
"C:\Users\Admin\AppData\Local\Temp\PO_60577.scr" /S
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explore" /t REG_SZ /d "C:\Users\Admin\explore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explore" /t REG_SZ /d "C:\Users\Admin\explore.exe"
    3⤵
    - Adds Run key to start application
    PID:1412
- C:\Users\Admin\explore.exe
  "C:\Users\Admin\explore.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-25-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/344-22-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/560-26-0x000007FEF6580000-0x000007FEF67FA000-memory.dmp

Download

memory/848-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/848-6-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/848-5-0x0000000000300000-0x000000000031E000-memory.dmp

Download

memory/848-3-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/1580-19-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/1580-18-0x00000000003E0000-0x00000000003EB000-memory.dmp

Download

memory/1580-14-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/1580-13-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads