lokibot | 1358629ee5a2a95f315fde2b02b2a406a66410c8f3a041211fe85c797692c93c

General

Target

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
Size

791KB
MD5

5d651714669a45db84939208acf9b50d
SHA1

db771f2ef555c278169d0dac547394cc133eb648
SHA256

1358629ee5a2a95f315fde2b02b2a406a66410c8f3a041211fe85c797692c93c
SHA512

576c38b751602197d53cb8a55fc3e8718b65316b2fc53a8a49c35e800a1d83c905ea043d36cdda2ee3b1a23ab07d13452dbb046bbf1b125d3bbb872b785eb40c

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/fn1ToJTMzu3Td

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

https://www.tepevizyon.com.tr/xx/Panel/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Executes dropped EXE 2 IoCs

Processes:

Ladudaqconsoleapp8m.exeLadudaqconsoleapp8m.exe

pid process

4076 Ladudaqconsoleapp8m.exe
1680 Ladudaqconsoleapp8m.exe

pid	process
4076	Ladudaqconsoleapp8m.exe
1680	Ladudaqconsoleapp8m.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exeLadudaqconsoleapp8m.exe

description	pid	process	target process
PID 3100 set thread context of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 4076 set thread context of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exeLadudaqconsoleapp8m.exe

pid	process
3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
4076	Ladudaqconsoleapp8m.exe
4076	Ladudaqconsoleapp8m.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe

pid process

2696 Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe

pid	process
2696	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exeCustomer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exeLadudaqconsoleapp8m.exeLadudaqconsoleapp8m.exe

description	pid	process
Token: SeDebugPrivilege	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
Token: SeDebugPrivilege	2696	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
Token: SeDebugPrivilege	4076	Ladudaqconsoleapp8m.exe
Token: SeDebugPrivilege	1680	Ladudaqconsoleapp8m.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exeWScript.exeLadudaqconsoleapp8m.exe

description	pid	process	target process
PID 3100 wrote to memory of 3776	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	WScript.exe
PID 3100 wrote to memory of 3776	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	WScript.exe
PID 3100 wrote to memory of 3776	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	WScript.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3100 wrote to memory of 2696	3100	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe	Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
PID 3776 wrote to memory of 4076	3776	WScript.exe	Ladudaqconsoleapp8m.exe
PID 3776 wrote to memory of 4076	3776	WScript.exe	Ladudaqconsoleapp8m.exe
PID 3776 wrote to memory of 4076	3776	WScript.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe
PID 4076 wrote to memory of 1680	4076	Ladudaqconsoleapp8m.exe	Ladudaqconsoleapp8m.exe

C:\Users\Admin\AppData\Local\Temp\Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bakyzxtncsftio.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
"C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Users\Admin\AppData\Local\Temp\Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Customer Advisory - Notice of implementing Congestion surcharge (CGD) (1).pdf.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bakyzxtncsftio.vbs
MD5
ad4c9fd3751187f271054a329048c002

SHA1
d4b25b3804ce41703dfb20be53cdbc13d879adfc

SHA256
ed4abed29e979acce477cc5ed435bb2c6d8a1401f75d95ec404b13fb22ee400a

SHA512
c590450c216acc6bf80a1eae94808f0a14042c8bea8b00ab2289957bb21b6704713b13e9fe293a3305cea6a4e618404e43856451807856fad096e9cf476ceaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
MD5
9e3dafee08217b05a6217c55ac4cee5e

SHA1
750a6b986fab11df9eef9a91a434171f48705599

SHA256
969023d5e0b8e904e5dd9b9fe9a819aaa068ec62bd33bb7d6118c4e4199572e7

SHA512
276a2381a88b79d03db2530867145566433a6a9534c91043f259685736a9a5c9f0e702e32e6d054d2dbc8b75b48e6b1c140f0259dbdd12d6d3ff47ae812b0dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
MD5
9e3dafee08217b05a6217c55ac4cee5e

SHA1
750a6b986fab11df9eef9a91a434171f48705599

SHA256
969023d5e0b8e904e5dd9b9fe9a819aaa068ec62bd33bb7d6118c4e4199572e7

SHA512
276a2381a88b79d03db2530867145566433a6a9534c91043f259685736a9a5c9f0e702e32e6d054d2dbc8b75b48e6b1c140f0259dbdd12d6d3ff47ae812b0dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ladudaqconsoleapp8m.exe
MD5
9e3dafee08217b05a6217c55ac4cee5e

SHA1
750a6b986fab11df9eef9a91a434171f48705599

SHA256
969023d5e0b8e904e5dd9b9fe9a819aaa068ec62bd33bb7d6118c4e4199572e7

SHA512
276a2381a88b79d03db2530867145566433a6a9534c91043f259685736a9a5c9f0e702e32e6d054d2dbc8b75b48e6b1c140f0259dbdd12d6d3ff47ae812b0dd2

Download Submit
C:\Users\Admin\AppData\Roaming\D180A8\8788BF.hdb
MD5
7b6821c03d45d0f441e8a4f8a5acdf1d

SHA1
e8bdbaa8bc2c0597ff9dc1031b9a01cc22371905

SHA256
a1083c91f85a7980b062fd204f2a435ea40575f4933c4950ade6f68c134c4388

SHA512
35fc3b3ace64ea80b93d4f37318bb73b7e7d6949d573a68e737def5f12b8dcc3a8f74afe12169f65b020f549d24727f64636aa966c2f059708133e87d3420811

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3686645723-710336880-414668232-1000\0f5007522459c86e95ffcc62f32308f1_89bbad60-16d5-41c2-ad8d-716f4ac5f4c2
MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/1680-147-0x00000000004139DE-mapping.dmp

Download
memory/1680-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1680-149-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2696-129-0x00000000004139DE-mapping.dmp

Download
memory/2696-128-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2696-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3100-114-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3100-125-0x0000000007190000-0x0000000007241000-memory.dmp

Filesize
708KB

Download
memory/3100-120-0x0000000006730000-0x00000000067CD000-memory.dmp

Filesize
628KB

Download
memory/3100-119-0x0000000004BC0000-0x00000000050BE000-memory.dmp

Filesize
5.0MB

Download
memory/3100-118-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/3100-117-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/3100-116-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/3776-126-0x0000000000000000-mapping.dmp

Download
memory/4076-132-0x0000000000000000-mapping.dmp

Download
memory/4076-145-0x0000000006A50000-0x0000000006AB1000-memory.dmp

Filesize
388KB

Download
memory/4076-140-0x0000000004CE0000-0x0000000004D2B000-memory.dmp

Filesize
300KB

Download
memory/4076-139-0x00000000049C0000-0x0000000004EBE000-memory.dmp

Filesize
5.0MB

Download
memory/4076-134-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads