lokibot | dfd6646d16dce4899cf47affa2d22b58ad515146ba71f3583a8f1d0c9cca4cc5

General

Target

RFQ2598HDOPDF.exe
Size

641KB
MD5

14cb2e30f01cad5ef47c622a4fc2e147
SHA1

010e92b23d9a3c4c42786d78748a2bee094926ab
SHA256

dfd6646d16dce4899cf47affa2d22b58ad515146ba71f3583a8f1d0c9cca4cc5
SHA512

c1b5e4d932d7a80ea6cdfc535d5ec4c1aaf60cb34a4ff3fbe4b874152de883001e3481371fc79ca8d971052e85c0241fed2fce80ba0b1ec254b88d22d6a4f5e4

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://apponline97.ir/china/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ2598HDOPDF.exe

description pid process target process

PID 1840 set thread context of 1788 1840 RFQ2598HDOPDF.exe RFQ2598HDOPDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

752 schtasks.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

RFQ2598HDOPDF.exe

pid process

1788 RFQ2598HDOPDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ2598HDOPDF.exe

description pid process

Token: SeDebugPrivilege 1788 RFQ2598HDOPDF.exe

description	pid	process	target process
PID 1840 set thread context of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe

pid	process
752	schtasks.exe

pid	process
1788	RFQ2598HDOPDF.exe

description	pid	process
Token: SeDebugPrivilege	1788	RFQ2598HDOPDF.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

RFQ2598HDOPDF.exe

description	pid	process	target process
PID 1840 wrote to memory of 752	1840	RFQ2598HDOPDF.exe	schtasks.exe
PID 1840 wrote to memory of 752	1840	RFQ2598HDOPDF.exe	schtasks.exe
PID 1840 wrote to memory of 752	1840	RFQ2598HDOPDF.exe	schtasks.exe
PID 1840 wrote to memory of 752	1840	RFQ2598HDOPDF.exe	schtasks.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 1840 wrote to memory of 1788	1840	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe

C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yojZBatXFPbVz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE263.tmp"
2⤵
- Creates scheduled task(s)
PID:752

C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE263.tmp
MD5
6f297c6d9b634f6ef05fb9916431074b

SHA1
1c5462eb8891d086f6ea92708cd1cf4246b0659d

SHA256
45445c352922a314c12dfb6d052d81491c68f8c2da1c89a070bdfd034862a1b1

SHA512
a915152a5025dba1c5d4968b8d621f85421301b940aee2cdcac55cac7bf123fc531262fdd1b14abda7c01e07f8f345d23f4cb1448b2905c95a65f4dea6c5b967

Download Submit
memory/752-66-0x0000000000000000-mapping.dmp

Download
memory/1788-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1788-69-0x00000000004139DE-mapping.dmp

Download
memory/1788-70-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1788-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1840-60-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1840-62-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/1840-63-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/1840-64-0x0000000007DF0000-0x0000000007E72000-memory.dmp

Filesize
520KB

Download
memory/1840-65-0x0000000000CB0000-0x0000000000CFD000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads