lokibot | 68d8eb06567fcf2d89595c4cef65212cb05c6bade4f14d9b013f2d457393bb32

General

Target
swift copy.exe
Size 603KB
Sample210602-gbespcnxt2
SHA256 68d8eb06567fcf2d89595c4cef65212cb05c6bade4f14d9b013f2d457393bb32
MD5 1d51b054f287bdb2098791d9c02cb080
SHA1 ca5884cb2cba181dbd439bf0a5e445a6e48a14b6
SHA512 bff3656eb1d6e7cf2dc0a4e28b5df7a814b8fd47bf5be92d1be4ccf1ba32d70b90d2d40afcad49cd0922b080a9af8026aed02e7a75929fcdb70d3234e140feb0
MD5 SHA1 SHA512

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fc5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 524	1756	swift copy.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1756	swift copy.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	swift copy.exe
Token: SeDebugPrivilege	524	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1532	1756	swift copy.exe	29
PID 1756 wrote to memory of 1532	1756	swift copy.exe	29
PID 1756 wrote to memory of 1532	1756	swift copy.exe	29
PID 1756 wrote to memory of 1532	1756	swift copy.exe	29
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31
PID 1756 wrote to memory of 524	1756	swift copy.exe	31

C:\Users\Admin\AppData\Local\Temp\swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sWJaXHHBhkYNK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA499.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/524-70-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download

memory/524-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1756-60-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/1756-62-0x00000000003F0000-0x00000000003F4000-memory.dmp

Download

memory/1756-63-0x0000000002170000-0x0000000002171000-memory.dmp

Download

memory/1756-64-0x0000000004BE0000-0x0000000004C49000-memory.dmp

Download

memory/1756-65-0x0000000000740000-0x0000000000764000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads