lokibot | 1fb769b269392860ff1951b079f7b8cf4bbe22e09a856e15fbb7a5426aa6a109

Analysis

max time kernel
126s
max time network
126s
platform
windows10_x64
resource
win10v20201028
submitted
25/01/2021, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vbc.exe
Size 531KB
Sample210125-jyy2axmgps
SHA256 1fb769b269392860ff1951b079f7b8cf4bbe22e09a856e15fbb7a5426aa6a109
MD5 dba3d7f3ca0f9c2d94b4d6830a344c93
SHA1 061757eb4edf849bf231ecd1448d4a04ce2dee81
SHA512 cc24593c24f34993c3c52d74b24543062a52bc1e9fbf022659e5e40b9da2de7b62bc59b68ecc760ce8ab9a4b47785073e48c7bd095d0aceb83b5dd41badfe01b
MD5 SHA1 SHA512

Score

10^/10

lokibot ransomware spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://mannaton.com/zoro/zoro3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
3180	ppbdbesr.exe
3188	i8eyvugel.exe

Loads dropped DLL 1 IoCs

pid	Process
728	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3180 set thread context of 3188	3180	ppbdbesr.exe	76

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe
3180	ppbdbesr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3180	ppbdbesr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	i8eyvugel.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3180	728	vbc.exe	75
PID 728 wrote to memory of 3180	728	vbc.exe	75
PID 728 wrote to memory of 3180	728	vbc.exe	75
PID 3180 wrote to memory of 3188	3180	ppbdbesr.exe	76
PID 3180 wrote to memory of 3188	3180	ppbdbesr.exe	76
PID 3180 wrote to memory of 3188	3180	ppbdbesr.exe	76
PID 3180 wrote to memory of 3188	3180	ppbdbesr.exe	76

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Local\Temp\.ABC\ppbdbesr.exe
  C:\Users\Admin\AppData\Local\Temp\.ABC\ppbdbesr.exe C:\Users\Admin\AppData\Local\Temp\.ABC\wsbnx.c
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\.ABC\i8eyvugel.exe
    C:\Users\Admin\AppData\Local\Temp\.ABC\ppbdbesr.exe C:\Users\Admin\AppData\Local\Temp\.ABC\wsbnx.c
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-9-0x0000000001230000-0x0000000001232000-memory.dmp

Download

memory/3188-10-0x0000000000400000-0x00000000004A2000-memory.dmp

Download