lokibot | 80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b

General

Target

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
Size

915KB
MD5

97902789babf5acb6b2e1a2bf34f026d
SHA1

9d51d7393bfd5eb16a81b2d304267267d25a24c4
SHA256

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b
SHA512

f2ee4eaf132f6840299de1381a768f1b5a2fce91cd6b73758bf9c5157e698d92b7876a638b61a3bba8b4c8fcba0ce53a90e2c3fd0fbdff9d74012f129ce266b8

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.18/dsaicosaicasdi.php/a5iPuKTGakcLJ

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

description	pid	process	target process
PID 3908 set thread context of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3832 schtasks.exe

pid	process
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

pid	process
3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

pid process

3520 80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

pid	process
3520	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

description	pid	process
Token: SeDebugPrivilege	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
Token: SeDebugPrivilege	3520	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

C:\Users\Admin\AppData\Local\Temp\80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
"C:\Users\Admin\AppData\Local\Temp\80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\beQchgpYlZnYm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85B0.tmp"
2⤵
- Creates scheduled task(s)
PID:3832

C:\Users\Admin\AppData\Local\Temp\80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
"{path}"
2⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
"{path}"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp85B0.tmp
MD5
d8f3d2a3f538b13cdd33c40092edc520

SHA1
d2d5baa260b094221bc8cac33d4a7abc81443c54

SHA256
05421224b4cf0717b6f9a7ad654b393f1b9a9a74c81a53995fdf6022a3263cf3

SHA512
bf3880b415c3882b414509fcaf22ebe7c78182ffb130925ad777183a734e3d96b329e7002d1e079b098e3ec46268edfc22298d96224202dd8d32a476e0a8273e

Download Submit
memory/3520-128-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3520-127-0x00000000004139DE-mapping.dmp

Download
memory/3520-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3832-124-0x0000000000000000-mapping.dmp

Download
memory/3908-118-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/3908-121-0x00000000084A0000-0x00000000084A1000-memory.dmp

Filesize
4KB

Download
memory/3908-122-0x0000000006C70000-0x0000000006D17000-memory.dmp

Filesize
668KB

Download
memory/3908-123-0x000000000AE70000-0x000000000AECB000-memory.dmp

Filesize
364KB

Download
memory/3908-120-0x00000000054B0000-0x00000000054B2000-memory.dmp

Filesize
8KB

Download
memory/3908-119-0x0000000004FE0000-0x00000000054DE000-memory.dmp

Filesize
5.0MB

Download
memory/3908-114-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3908-117-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3908-116-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 3908 wrote to memory of 3832	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	schtasks.exe
PID 3908 wrote to memory of 3832	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	schtasks.exe
PID 3908 wrote to memory of 3832	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	schtasks.exe
PID 3908 wrote to memory of 3492	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3492	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3492	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe
PID 3908 wrote to memory of 3520	3908	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe	80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads