lokibot | 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c

General

Target

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Size

567KB
MD5

e14c457400ef8b306e40f1e12f50b5bf
SHA1

4de6f90a078773b488471d9b213c8f22c2a05cce
SHA256

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c
SHA512

ab6904be14019d886a99a78ae1e228ac1c7223e2f2ec461a3122b60e78c17c1fe77d3996cf4645c71183fd5409afd2832a3cd9bdd1a9d74de2aa2e2221fead70

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://lightloog.ddns.net/log/panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process	target process
PID 508 set thread context of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3920 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid process

508 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid process

2492 9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid	process
3920	schtasks.exe

pid	process
508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

pid	process
2492	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process
Token: SeDebugPrivilege	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
Token: SeDebugPrivilege	2492	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

description	pid	process	target process
PID 508 wrote to memory of 3920	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 508 wrote to memory of 3920	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 508 wrote to memory of 3920	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	schtasks.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
PID 508 wrote to memory of 2492	508	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe	9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe

C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
"C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wyxnalIGKECEBH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF41A.tmp"
2⤵
- Creates scheduled task(s)
PID:3920

C:\Users\Admin\AppData\Local\Temp\9f4258e5c61e45d8cedece680a26b83be12413727685afdf469bc91727751a8c.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF41A.tmp
MD5
4a89823308f2dbe0f0c0f4083f9aac90

SHA1
48eef57c3f1f889a74fbdc2f03072c75aaaa5bc2

SHA256
5738baba2a4c3bf2b15efc1ee50a426590ce73346c83d704d4d83352d33f81d1

SHA512
0a7a67511ac174d7fc63d33dc2fa9e24e736a2c64433cd92dea0f65cc8d7c1f08806065d01f4d127baa3c40a1eb658746cc5a565c958ff815a5ea2d24092d3d2

Download Submit
memory/508-6-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/508-5-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/508-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/508-7-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/508-8-0x00000000057A0000-0x00000000057AE000-memory.dmp

Filesize
56KB

Download
memory/508-9-0x0000000007B10000-0x0000000007B8F000-memory.dmp

Filesize
508KB

Download
memory/508-10-0x0000000007C30000-0x0000000007C31000-memory.dmp

Filesize
4KB

Download
memory/508-3-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/2492-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2492-14-0x00000000004139DE-mapping.dmp

Download
memory/2492-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3920-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads