lokibot | 95adc30ed6495e078a795b6184442b4147e87e1e48bd040467c0d190cabbf092

General

Target
C56CFBC256132F6C04A193A47EF4949C.exe
Size 488KB
Sample210622-4ctee2e53j
SHA256 95adc30ed6495e078a795b6184442b4147e87e1e48bd040467c0d190cabbf092
MD5 c56cfbc256132f6c04a193a47ef4949c
SHA1 5649611b8d4f5c73c99643e4005ee83c094496ae
SHA512 36b59312073be11d5ca3947ed41e61fed99fe28fe1cdc5f835e741d2bdcd265ff21362833c5ce4cdfc19fd4df3eaa7b55ac699bd724e1f17176c9132d37737fc
MD5 SHA1 SHA512

Score

10^/10

lokibot persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.198.57.204/kboy/sync/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1692	filename.exe
568	filename.exe

Loads dropped DLL 3 IoCs

pid	Process
1244	WScript.exe
1244	WScript.exe
1692	filename.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Registry Key Name = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filename.vbs"	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 568	1692	filename.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	filename.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1096	C56CFBC256132F6C04A193A47EF4949C.exe
1692	filename.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1244	1096	C56CFBC256132F6C04A193A47EF4949C.exe	29
PID 1096 wrote to memory of 1244	1096	C56CFBC256132F6C04A193A47EF4949C.exe	29
PID 1096 wrote to memory of 1244	1096	C56CFBC256132F6C04A193A47EF4949C.exe	29
PID 1096 wrote to memory of 1244	1096	C56CFBC256132F6C04A193A47EF4949C.exe	29
PID 1244 wrote to memory of 1692	1244	WScript.exe	30
PID 1244 wrote to memory of 1692	1244	WScript.exe	30
PID 1244 wrote to memory of 1692	1244	WScript.exe	30
PID 1244 wrote to memory of 1692	1244	WScript.exe	30
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31
PID 1692 wrote to memory of 568	1692	filename.exe	31

C:\Users\Admin\AppData\Local\Temp\C56CFBC256132F6C04A193A47EF4949C.exe
"C:\Users\Admin\AppData\Local\Temp\C56CFBC256132F6C04A193A47EF4949C.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbs"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
    "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe
      "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-76-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/568-80-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1096-61-0x00000000003D0000-0x00000000003D6000-memory.dmp

Download

memory/1096-62-0x0000000075281000-0x0000000075283000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads