lokibot | a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52

General

Target

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
Size

1.4MB
MD5

9765acf7509b0800d88d96a629c0cc24
SHA1

41ca7dd1724c8a4f880c6c9094debdf3796c3c51
SHA256

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52
SHA512

c13cfc90c81b4d22389854d5514cc6f2f4e37cec6205c52e2cf40373345963f62bb76650bcf7d67813382cb2e5aa5e88c44b2ea3d1c527a5b1d61546fc2f74a6

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://63.141.228.141/32.php/3V16BrI6suXPx

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

description	pid	process	target process
PID 1732 set thread context of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1644 schtasks.exe

pid	process
1644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

pid	process
1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

pid process

556 a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

pid	process
556	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exea222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

description	pid	process
Token: SeDebugPrivilege	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
Token: SeDebugPrivilege	556	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

description	pid	process	target process
PID 1732 wrote to memory of 1644	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	schtasks.exe
PID 1732 wrote to memory of 1644	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	schtasks.exe
PID 1732 wrote to memory of 1644	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	schtasks.exe
PID 1732 wrote to memory of 1644	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	schtasks.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
PID 1732 wrote to memory of 556	1732	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe	a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe

C:\Users\Admin\AppData\Local\Temp\a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
"C:\Users\Admin\AppData\Local\Temp\a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HZJUoSTieh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA007.tmp"
2⤵
- Creates scheduled task(s)
PID:1644

C:\Users\Admin\AppData\Local\Temp\a222f23b44ac7af5cbac74e3f60643e232ed63d8a79162d58084f5fcce5dfd52.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA007.tmp
MD5
ad3b25d2c8a6e1d7d5d20733d84a620c

SHA1
0f21249c84492709571ec2256645c3a50151350d

SHA256
ca7f940cee82c39f0cdd07e357ea9841d841a1c813b8efb734f4e529ca5ee147

SHA512
9dbdd033a1e9fb0d8bf793e38dc91835f41f25a8956c83fc76c965f6be072cdb7ab4d0953363449c22ce84156966920f9d1f3f4904c783e0e6c96349b44b2f59

Download Submit
memory/556-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/556-68-0x00000000004139DE-mapping.dmp

Download
memory/556-69-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/556-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-65-0x0000000000000000-mapping.dmp

Download
memory/1732-59-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/1732-61-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/1732-62-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/1732-63-0x0000000007340000-0x00000000073A6000-memory.dmp

Filesize
408KB

Download
memory/1732-64-0x0000000000CC0000-0x0000000000CDD000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads