lokibot | 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c

General

Target

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Size

567KB
MD5

e14c457400ef8b306e40f1e12f50b5bf
SHA1

4de6f90a078773b488471d9b213c8f22c2a05cce
SHA256

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c
SHA512

ab6904be14019d886a99a78ae1e228ac1c7223e2f2ec461a3122b60e78c17c1fe77d3996cf4645c71183fd5409afd2832a3cd9bdd1a9d74de2aa2e2221fead70

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://lightloog.ddns.net/log/panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process	target process
PID 292 set thread context of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

480 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid process

292 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid process

980 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid	process
480	schtasks.exe

pid	process
292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid	process
980	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process
Token: SeDebugPrivilege	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Token: SeDebugPrivilege	980	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process	target process
PID 292 wrote to memory of 480	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 292 wrote to memory of 480	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 292 wrote to memory of 480	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 292 wrote to memory of 480	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 292 wrote to memory of 980	292	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
"C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wyxnalIGKECEBH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA3CE.tmp"
2⤵
- Creates scheduled task(s)
PID:480

C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA3CE.tmp
MD5
2370e5d47b87af5ca7f33e08b0dbc949

SHA1
aabfadc13c41c534fd6af78381dbe417e57fca4e

SHA256
c0be5f4a3ece156e2f9a185b8871e18c8d65a1162f12e4924cc2e00a00bd38e6

SHA512
a8f4bb01bb143ab34880583ac4f80b1a28e76b05ddbeca7b0e2f4152dd43987c44b038db3ffc0d92a902bc522b5e9dc36a4e4e62644d0ea6cd3f7cb597282bf8

Download Submit
memory/292-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/292-3-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/292-5-0x0000000000A90000-0x0000000000A9E000-memory.dmp

Filesize
56KB

Download
memory/292-6-0x0000000005620000-0x000000000569F000-memory.dmp

Filesize
508KB

Download
memory/480-7-0x0000000000000000-mapping.dmp

Download
memory/980-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/980-10-0x00000000004139DE-mapping.dmp

Download
memory/980-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1548-12-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads