lokibot | b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153

General

Target

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
Size

814KB
MD5

541bb6e026f837faa2b64b31b0a2ec0c
SHA1

1cd6d3ceae4177bba8add5ef473b80edb6bc55d3
SHA256

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153
SHA512

2c880847e2fbf0f221eeae08c8997ad9b36c8f32e00d93ca3fdf9283bf895160378f3839770643353bb2fdccf7a529f02040881efef7d5cb2b91732c66ccede9

Score

10^/10

lokibot spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://192.236.179.121/new/zubby/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

description	pid	process	target process
PID 320 set thread context of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

616 schtasks.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

pid process

1452 b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

description pid process

Token: SeDebugPrivilege 1452 b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

pid	process
616	schtasks.exe

pid	process
1452	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

description	pid	process
Token: SeDebugPrivilege	1452	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

description	pid	process	target process
PID 320 wrote to memory of 616	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	schtasks.exe
PID 320 wrote to memory of 616	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	schtasks.exe
PID 320 wrote to memory of 616	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	schtasks.exe
PID 320 wrote to memory of 616	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	schtasks.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
PID 320 wrote to memory of 1452	320	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe	b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe

C:\Users\Admin\AppData\Local\Temp\b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
"C:\Users\Admin\AppData\Local\Temp\b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dNmETqTEL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D41.tmp"
2⤵
- Creates scheduled task(s)
PID:616

C:\Users\Admin\AppData\Local\Temp\b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe
"C:\Users\Admin\AppData\Local\Temp\b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153.exe"
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1D41.tmp
MD5
f9f779bd9fd6399222e300991f58d00d

SHA1
a714ce6f584e5067d9b27bcf3a2f7b11ee7795c5

SHA256
3f9b009ec61513f4e8f7bef20b41fe51cc4d7d152e1c9e662c136fdb87da6fb4

SHA512
d18918ebd795138f0108f9a3e82371015d85e78eacabb6e8bdf7fc331fe688081e2b0ea98c21247b0dc16fa0626065d39b86a3b0e4c7e2b0b1337ed8e92cdc96

Download Submit
memory/320-59-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/320-61-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/320-62-0x0000000000530000-0x000000000054B000-memory.dmp

Filesize
108KB

Download
memory/320-63-0x0000000004BD0000-0x0000000004C34000-memory.dmp

Filesize
400KB

Download
memory/320-64-0x0000000000630000-0x0000000000650000-memory.dmp

Filesize
128KB

Download
memory/616-65-0x0000000000000000-mapping.dmp

Download
memory/1452-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1452-68-0x00000000004139DE-mapping.dmp

Download
memory/1452-69-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1452-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads