lokibot | 7fe3cf53819cc62bd4c5812de2db482e05c0a77fbfb42413863c4967596458df

General

Target

gunzipped.exe
Size

811KB
MD5

5c67d88f6e0d9a814ca812637c2355df
SHA1

2cbc7f5c8dbe68e94755ffa33b3d53d7f0e2c439
SHA256

7fe3cf53819cc62bd4c5812de2db482e05c0a77fbfb42413863c4967596458df
SHA512

280b6e199bfb089ec1fab68d5da5395fa49227fe939f1e7d9741849216dc9ffd6f54f1777779ae59092601e4f909d71f6b3e56f62e33bfb7dd900561dc160be7

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/yefJbphgQgDjo

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

gunzipped.exe

description pid process target process

PID 3944 set thread context of 4032 3944 gunzipped.exe gunzipped.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4076 schtasks.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

gunzipped.exe

pid process

4032 gunzipped.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gunzipped.exe

description pid process

Token: SeDebugPrivilege 4032 gunzipped.exe

description	pid	process	target process
PID 3944 set thread context of 4032	3944	gunzipped.exe	gunzipped.exe

pid	process
4076	schtasks.exe

pid	process
4032	gunzipped.exe

description	pid	process
Token: SeDebugPrivilege	4032	gunzipped.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

gunzipped.exe

description	pid	process	target process
PID 3944 wrote to memory of 4076	3944	gunzipped.exe	schtasks.exe
PID 3944 wrote to memory of 4076	3944	gunzipped.exe	schtasks.exe
PID 3944 wrote to memory of 4076	3944	gunzipped.exe	schtasks.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe
PID 3944 wrote to memory of 4032	3944	gunzipped.exe	gunzipped.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ISlFCJknYqAj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA691.tmp"
2⤵
- Creates scheduled task(s)
PID:4076

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA691.tmp
MD5
ec9c664c3f55b6e272fb235576e6bab5

SHA1
0e65c36b6c2614e855cbf751e4c0fef3bd477975

SHA256
eff7406b99c93516b4eb9616f2490b5f6e921c7a7a2217b3e3ca22ec50d0a80c

SHA512
4784864806c0e270beb63c305b368ad33c3ea8a458e9ec9a61d621eabe1f1197f9797524a7dbe588557f5e655cb4c1ab25c6e838727c528c28441e9955191899

Download Submit
memory/3944-122-0x0000000005AE0000-0x0000000005AE4000-memory.dmp

Filesize
16KB

Download
memory/3944-123-0x0000000006540000-0x00000000065F4000-memory.dmp

Filesize
720KB

Download
memory/3944-118-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3944-119-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3944-120-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/3944-114-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/3944-121-0x0000000005700000-0x0000000005BFE000-memory.dmp

Filesize
5.0MB

Download
memory/3944-117-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/3944-124-0x0000000001670000-0x00000000016E3000-memory.dmp

Filesize
460KB

Download
memory/3944-116-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/4032-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4032-128-0x00000000004139DE-mapping.dmp

Download
memory/4032-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4076-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads