lokibot | 897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38

General

Target

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
Size

1.3MB
MD5

66f1cf3848c36e8111dc5f5a5784c2ad
SHA1

ad817b424694418345401fd28073dcaf4a24b22d
SHA256

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38
SHA512

03b8b77555909c114b380f5a4dab50e817c5edf4e23fc5eddc92c61c758ca98cdb6fadfe8f8eea3162f3831cba1cccf7a969e28bc106c775205e630fc4404e33

Score

10^/10

lokibot evasion spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/dUQz9bwGRLNK7

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

description	pid	process	target process
PID 796 set thread context of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1336 schtasks.exe

pid	process
1336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

pid	process
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

pid process

3216 897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

pid	process
3216	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

description	pid	process
Token: SeDebugPrivilege	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
Token: SeDebugPrivilege	3216	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

C:\Users\Admin\AppData\Local\Temp\897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
"C:\Users\Admin\AppData\Local\Temp\897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNNTPHTOG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEDFF.tmp"
2⤵
- Creates scheduled task(s)
PID:1336

C:\Users\Admin\AppData\Local\Temp\897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
"{path}"
2⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEDFF.tmp
MD5
5387d2f2d3b8c3ee9afe26cb98e32a24

SHA1
de5fae56eb95c8cd71a722b69174699787f4da8b

SHA256
aaa1e78ee410c0db6451f8b7800c9254ba7d80ab20f9ab6c59425ad59c6a9ada

SHA512
abf33eb41d137f8869b49324ff69f54e769144ae167a5570dae7baba4c00727f1aa4176ed47eaf0aabb460c7ad7547031002899f1bcf08b38a80e3f665ced210

Download Submit
memory/796-7-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/796-12-0x00000000088C0000-0x00000000088C1000-memory.dmp

Filesize
4KB

Download
memory/796-6-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/796-2-0x00000000730E0000-0x00000000737CE000-memory.dmp

Filesize
6.9MB

Download
memory/796-8-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/796-9-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/796-5-0x0000000004D70000-0x0000000004DD2000-memory.dmp

Filesize
392KB

Download
memory/796-11-0x0000000005DB0000-0x0000000005DF5000-memory.dmp

Filesize
276KB

Download
memory/796-10-0x0000000005FA0000-0x0000000005FAE000-memory.dmp

Filesize
56KB

Download
memory/796-13-0x0000000008960000-0x0000000008961000-memory.dmp

Filesize
4KB

Download
memory/796-3-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1336-14-0x0000000000000000-mapping.dmp

Download
memory/3216-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3216-17-0x00000000004139DE-mapping.dmp

Download
memory/3216-18-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

description	pid	process	target process
PID 796 wrote to memory of 1336	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	schtasks.exe
PID 796 wrote to memory of 1336	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	schtasks.exe
PID 796 wrote to memory of 1336	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	schtasks.exe
PID 796 wrote to memory of 1800	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 1800	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 1800	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
PID 796 wrote to memory of 3216	796	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe	897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads