lokibot | 7fe3cf53819cc62bd4c5812de2db482e05c0a77fbfb42413863c4967596458df

General

Target

gunzipped.exe
Size

811KB
MD5

5c67d88f6e0d9a814ca812637c2355df
SHA1

2cbc7f5c8dbe68e94755ffa33b3d53d7f0e2c439
SHA256

7fe3cf53819cc62bd4c5812de2db482e05c0a77fbfb42413863c4967596458df
SHA512

280b6e199bfb089ec1fab68d5da5395fa49227fe939f1e7d9741849216dc9ffd6f54f1777779ae59092601e4f909d71f6b3e56f62e33bfb7dd900561dc160be7

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/yefJbphgQgDjo

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

gunzipped.exe

description pid process target process

PID 1028 set thread context of 1292 1028 gunzipped.exe gunzipped.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

892 schtasks.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

gunzipped.exe

pid process

1292 gunzipped.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gunzipped.exe

description pid process

Token: SeDebugPrivilege 1292 gunzipped.exe

description	pid	process	target process
PID 1028 set thread context of 1292	1028	gunzipped.exe	gunzipped.exe

pid	process
892	schtasks.exe

pid	process
1292	gunzipped.exe

description	pid	process
Token: SeDebugPrivilege	1292	gunzipped.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

gunzipped.exe

description	pid	process	target process
PID 1028 wrote to memory of 892	1028	gunzipped.exe	schtasks.exe
PID 1028 wrote to memory of 892	1028	gunzipped.exe	schtasks.exe
PID 1028 wrote to memory of 892	1028	gunzipped.exe	schtasks.exe
PID 1028 wrote to memory of 892	1028	gunzipped.exe	schtasks.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe
PID 1028 wrote to memory of 1292	1028	gunzipped.exe	gunzipped.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ISlFCJknYqAj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF26A.tmp"
2⤵
- Creates scheduled task(s)
PID:892

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF26A.tmp
MD5
8d4aa860a74ecae596370a2c2f27fa4f

SHA1
277724d8ef6c0fdb2f3833bad47e507ca6cafd48

SHA256
0b3ac6e2c6d112be7d1c2b4c5491e724daa4a0fb5a4c4321aa880c12c159854a

SHA512
114384d5b53cf66a132d4fd4988e32d01edd09dcfae712c174179a2095c44a02a881a680e2760f19c6c1fd7aabe15629dc4d2d0b23b883031c23595afe0d84b0

Download Submit
memory/892-65-0x0000000000000000-mapping.dmp

Download
memory/1028-59-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1028-61-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/1028-62-0x0000000000370000-0x0000000000374000-memory.dmp

Filesize
16KB

Download
memory/1028-63-0x0000000005120000-0x00000000051D4000-memory.dmp

Filesize
720KB

Download
memory/1028-64-0x0000000004A70000-0x0000000004AE3000-memory.dmp

Filesize
460KB

Download
memory/1292-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1292-68-0x00000000004139DE-mapping.dmp

Download
memory/1292-69-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1292-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads