lokibot | f35a2268af460c9d1dd472608376c7877aca3b037e030ee6366d2e41a1f25818

General

Target

ORDER.exe
Size

789KB
MD5

b954b768fcdca7acd4a9e43715139650
SHA1

343bd24a325dfd24f7ccb0ece3052175c7187002
SHA256

f35a2268af460c9d1dd472608376c7877aca3b037e030ee6366d2e41a1f25818
SHA512

31994bbcfe804827574c2f9148768ceb8c120afbd0c0275b62448b83044c270982f11e813b83c65243782203279540a12eeba84fb67904e8a6b2c73ac7fa2001

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://192.119.111.43/smack/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER.exe

description pid process target process

PID 1072 set thread context of 892 1072 ORDER.exe ORDER.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

320 schtasks.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ORDER.exe

pid process

892 ORDER.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ORDER.exeORDER.exe

description pid process

Token: SeDebugPrivilege 1072 ORDER.exe
Token: SeDebugPrivilege 892 ORDER.exe

description	pid	process	target process
PID 1072 set thread context of 892	1072	ORDER.exe	ORDER.exe

pid	process
320	schtasks.exe

pid	process
892	ORDER.exe

description	pid	process
Token: SeDebugPrivilege	1072	ORDER.exe
Token: SeDebugPrivilege	892	ORDER.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ORDER.exe

description	pid	process	target process
PID 1072 wrote to memory of 320	1072	ORDER.exe	schtasks.exe
PID 1072 wrote to memory of 320	1072	ORDER.exe	schtasks.exe
PID 1072 wrote to memory of 320	1072	ORDER.exe	schtasks.exe
PID 1072 wrote to memory of 320	1072	ORDER.exe	schtasks.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe
PID 1072 wrote to memory of 892	1072	ORDER.exe	ORDER.exe

C:\Users\Admin\AppData\Local\Temp\ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XAOlwfcRy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F77.tmp"
2⤵
- Creates scheduled task(s)
PID:320

C:\Users\Admin\AppData\Local\Temp\ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4F77.tmp
MD5
5d30b2d72d2113930cf4e7b95146e580

SHA1
a330b5a41ddff10c6b12891ff2331cd47ce54e51

SHA256
cabf3d57503e9ef5dcdf98b6b91644bf3bb21c01171df61cf25b0488b96610fe

SHA512
d9c5515b8982288bac3b1907c2539e53265ab3c1cdd4998fd285090cbd40ea98939f3ebe497bb10bb5332b1acf1278f592a34c7a584bc7dc0db6ac2150835e56

Download Submit
memory/320-65-0x0000000000000000-mapping.dmp

Download
memory/892-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/892-68-0x00000000004139DE-mapping.dmp

Download
memory/892-69-0x00000000752F1000-0x00000000752F3000-memory.dmp

Filesize
8KB

Download
memory/892-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1072-59-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/1072-61-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/1072-62-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1072-63-0x0000000007760000-0x00000000077E0000-memory.dmp

Filesize
512KB

Download
memory/1072-64-0x00000000004D0000-0x000000000051D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads