lokibot | ad59b833a3362f5535f199dcbb11d27c4159d339ef7eea63993f1e4a0cc39d1b

General

Target
DHL Receipt.exe
Size 826KB
Sample210428-p7f15j4vr2
SHA256 ad59b833a3362f5535f199dcbb11d27c4159d339ef7eea63993f1e4a0cc39d1b
MD5 5e50aff69149ea6fa355e228d0aad56d
SHA1 80d491afa2872dd970816162e6d56dcb39bb5951
SHA512 c3ed473185097cb68413b51cd24e6a80d56de382d215b95135611d572b20735c46e4f891375a723334f395b307d2cd95b7ce4222040849eec4d7aa0e92c06296
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/qQDv4aFt6Ob1S
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 732	1116	DHL Receipt.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1116	DHL Receipt.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
732	DHL Receipt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	DHL Receipt.exe
Token: SeDebugPrivilege	732	DHL Receipt.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 788	1116	DHL Receipt.exe	29
PID 1116 wrote to memory of 788	1116	DHL Receipt.exe	29
PID 1116 wrote to memory of 788	1116	DHL Receipt.exe	29
PID 1116 wrote to memory of 788	1116	DHL Receipt.exe	29
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31
PID 1116 wrote to memory of 732	1116	DHL Receipt.exe	31

C:\Users\Admin\AppData\Local\Temp\DHL Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Receipt.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tuXKJTLnfa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A4C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:788
- C:\Users\Admin\AppData\Local\Temp\DHL Receipt.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/732-70-0x00000000767B1000-0x00000000767B3000-memory.dmp

Download

memory/732-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1116-60-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/1116-62-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/1116-63-0x0000000000410000-0x000000000041E000-memory.dmp

Download

memory/1116-64-0x0000000005DB0000-0x0000000005E4C000-memory.dmp

Download

memory/1116-65-0x0000000000C90000-0x0000000000CE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads