lokibot | dfd6646d16dce4899cf47affa2d22b58ad515146ba71f3583a8f1d0c9cca4cc5

General

Target

RFQ2598HDOPDF.exe
Size

641KB
MD5

14cb2e30f01cad5ef47c622a4fc2e147
SHA1

010e92b23d9a3c4c42786d78748a2bee094926ab
SHA256

dfd6646d16dce4899cf47affa2d22b58ad515146ba71f3583a8f1d0c9cca4cc5
SHA512

c1b5e4d932d7a80ea6cdfc535d5ec4c1aaf60cb34a4ff3fbe4b874152de883001e3481371fc79ca8d971052e85c0241fed2fce80ba0b1ec254b88d22d6a4f5e4

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://apponline97.ir/china/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ2598HDOPDF.exe

description pid process target process

PID 3904 set thread context of 3936 3904 RFQ2598HDOPDF.exe RFQ2598HDOPDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RFQ2598HDOPDF.exe

pid process

3904 RFQ2598HDOPDF.exe
3904 RFQ2598HDOPDF.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

RFQ2598HDOPDF.exe

pid process

3936 RFQ2598HDOPDF.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ2598HDOPDF.exeRFQ2598HDOPDF.exe

description pid process

Token: SeDebugPrivilege 3904 RFQ2598HDOPDF.exe
Token: SeDebugPrivilege 3936 RFQ2598HDOPDF.exe

description	pid	process	target process
PID 3904 set thread context of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe

pid	process
1320	schtasks.exe

pid	process
3904	RFQ2598HDOPDF.exe
3904	RFQ2598HDOPDF.exe

pid	process
3936	RFQ2598HDOPDF.exe

description	pid	process
Token: SeDebugPrivilege	3904	RFQ2598HDOPDF.exe
Token: SeDebugPrivilege	3936	RFQ2598HDOPDF.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RFQ2598HDOPDF.exe

description	pid	process	target process
PID 3904 wrote to memory of 1320	3904	RFQ2598HDOPDF.exe	schtasks.exe
PID 3904 wrote to memory of 1320	3904	RFQ2598HDOPDF.exe	schtasks.exe
PID 3904 wrote to memory of 1320	3904	RFQ2598HDOPDF.exe	schtasks.exe
PID 3904 wrote to memory of 3836	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3836	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3836	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe
PID 3904 wrote to memory of 3936	3904	RFQ2598HDOPDF.exe	RFQ2598HDOPDF.exe

C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yojZBatXFPbVz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE02.tmp"
2⤵
- Creates scheduled task(s)
PID:1320

C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe"
2⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2598HDOPDF.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDE02.tmp
MD5
979fc3f0d7f73b822998316d0679cb90

SHA1
1fd06bcc7bf72addc1bb42b928ebbe1ff3026b7d

SHA256
b68f78ba0efae1be7721274e1dd14c3fefc9ddc9b47188ccf88da004e57e9491

SHA512
fd0ec1d68ff43a55023616407c3b745a19b992e28c5b89a160b6fe986cdc532d1c7fda40f202c1dd8dce25d6e0eeb065a0f487fe17d57464d489d3e9125761dc

Download Submit
memory/1320-124-0x0000000000000000-mapping.dmp

Download
memory/3904-118-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/3904-114-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3904-119-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/3904-120-0x0000000005370000-0x000000000586E000-memory.dmp

Filesize
5.0MB

Download
memory/3904-121-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/3904-122-0x00000000089D0000-0x0000000008A52000-memory.dmp

Filesize
520KB

Download
memory/3904-123-0x000000000B170000-0x000000000B1BD000-memory.dmp

Filesize
308KB

Download
memory/3904-117-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/3904-116-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/3936-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3936-127-0x00000000004139DE-mapping.dmp

Download
memory/3936-128-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads