lokibot | 146895757ccfcc5080a9b371aade4468d1fc0c85accb4d907f6be49927c6d2c3

General

Target

RvpOjGNoeUrU5YI.exe
Size

1.1MB
MD5

40898897810b8ed4004003c936ac40ee
SHA1

f7ce06775d627c33e53d2fe49b0dc61dc6e2f8b6
SHA256

146895757ccfcc5080a9b371aade4468d1fc0c85accb4d907f6be49927c6d2c3
SHA512

fd8bb723ff16c45ebe70ff2f36fc7ea5818e44f8eb02cb114f3e24a6f714ac23e050eee060f809ae5f316cd568e6e3c551fe89aa304a3f0380b58be49c180666

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/3LJAZguIGMmJV

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

RvpOjGNoeUrU5YI.exe

description pid process target process

PID 908 set thread context of 1348 908 RvpOjGNoeUrU5YI.exe RvpOjGNoeUrU5YI.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1944 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RvpOjGNoeUrU5YI.exe

pid process

908 RvpOjGNoeUrU5YI.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

RvpOjGNoeUrU5YI.exe

pid process

1348 RvpOjGNoeUrU5YI.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RvpOjGNoeUrU5YI.exeRvpOjGNoeUrU5YI.exe

description pid process

Token: SeDebugPrivilege 908 RvpOjGNoeUrU5YI.exe
Token: SeDebugPrivilege 1348 RvpOjGNoeUrU5YI.exe

description	pid	process	target process
PID 908 set thread context of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe

pid	process
1944	schtasks.exe

pid	process
908	RvpOjGNoeUrU5YI.exe

pid	process
1348	RvpOjGNoeUrU5YI.exe

description	pid	process
Token: SeDebugPrivilege	908	RvpOjGNoeUrU5YI.exe
Token: SeDebugPrivilege	1348	RvpOjGNoeUrU5YI.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RvpOjGNoeUrU5YI.exe

description	pid	process	target process
PID 908 wrote to memory of 1944	908	RvpOjGNoeUrU5YI.exe	schtasks.exe
PID 908 wrote to memory of 1944	908	RvpOjGNoeUrU5YI.exe	schtasks.exe
PID 908 wrote to memory of 1944	908	RvpOjGNoeUrU5YI.exe	schtasks.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe
PID 908 wrote to memory of 1348	908	RvpOjGNoeUrU5YI.exe	RvpOjGNoeUrU5YI.exe

C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe
"C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SefcAaptyL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A0E.tmp"
2⤵
- Creates scheduled task(s)
PID:1944

C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe
"C:\Users\Admin\AppData\Local\Temp\RvpOjGNoeUrU5YI.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9A0E.tmp
MD5
10c5d1c2464423f259aaa2ebf38d545a

SHA1
114eee2001e8699c3cd4034c784f6119143dfea3

SHA256
144228a8feb279bb6efa950497dbe5a4ac70520581f572bb23ed4e6f7c4176a8

SHA512
94e230623fb0f49c90533fbdb1ba5b7486cd5514150058d6f8405a01983030f195f64bc49b31af36184c36babba04c7d069d7730493796486a5f69343110eb50

Download Submit
memory/908-121-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/908-123-0x00000000010E0000-0x0000000001148000-memory.dmp

Filesize
416KB

Download
memory/908-118-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/908-119-0x00000000051C0000-0x00000000056BE000-memory.dmp

Filesize
5.0MB

Download
memory/908-120-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/908-114-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/908-122-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/908-117-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/908-124-0x0000000001190000-0x00000000011C0000-memory.dmp

Filesize
192KB

Download
memory/908-116-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/1348-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1348-128-0x00000000004139DE-mapping.dmp

Download
memory/1348-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1944-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads