lokibot | 73a2b7c5a949d1439f4a729aca0e7a13f428dc0394416c73ec4fce7b2810da2b

General

Target
order confirmationpdf.exe
Size 945KB
Sample210526-fbjsctj1za
SHA256 73a2b7c5a949d1439f4a729aca0e7a13f428dc0394416c73ec4fce7b2810da2b
MD5 518af17907184688b9a3724dda07edc9
SHA1 d888529ed676c9d14f48a93d5bfc9a43c764f24e
SHA512 a4f03ecf1e09c3859fd2e07efec17f128bdacdabd06511776ebec2578bfd3ba68f885d30d179b4e25f0964dcc19908f539407a99b1547e0b73394798401285d5
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1264	1104	order confirmationpdf.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	order confirmationpdf.exe
1104	order confirmationpdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	order confirmationpdf.exe
Token: SeDebugPrivilege	1264	vbc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 332	1104	order confirmationpdf.exe	29
PID 1104 wrote to memory of 332	1104	order confirmationpdf.exe	29
PID 1104 wrote to memory of 332	1104	order confirmationpdf.exe	29
PID 1104 wrote to memory of 332	1104	order confirmationpdf.exe	29
PID 1104 wrote to memory of 680	1104	order confirmationpdf.exe	31
PID 1104 wrote to memory of 680	1104	order confirmationpdf.exe	31
PID 1104 wrote to memory of 680	1104	order confirmationpdf.exe	31
PID 1104 wrote to memory of 680	1104	order confirmationpdf.exe	31
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32
PID 1104 wrote to memory of 1264	1104	order confirmationpdf.exe	32

C:\Users\Admin\AppData\Local\Temp\order confirmationpdf.exe
"C:\Users\Admin\AppData\Local\Temp\order confirmationpdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VfArYRNxrJGTq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA016.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1264