lokibot | 26726a1e321ed1e0f39b676a56b38eb41641f734aa05e0a9669c6144b53ee191

General

Target
Document Delivery 28-09-21pdf.exe
Size 634KB
Sample210928-fe5vmsaef7
SHA256 26726a1e321ed1e0f39b676a56b38eb41641f734aa05e0a9669c6144b53ee191
MD5 263a4566cfccc024d4f6f198017c24ce
SHA1 a79bf9f7d83e07295b7fcc22c25d7694f193f884
SHA512 8313847617ab7a4d66889cf2754f84735fb01890696e5dabd54a07dca693c60e06649efee5fdb27444f26888a77d7b209cf6a784cb3ea3edbc93ad9520657033
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 1856	1556	Document Delivery 28-09-21pdf.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1668	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1856	Document Delivery 28-09-21pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	Document Delivery 28-09-21pdf.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1668	1556	Document Delivery 28-09-21pdf.exe	27
PID 1556 wrote to memory of 1668	1556	Document Delivery 28-09-21pdf.exe	27
PID 1556 wrote to memory of 1668	1556	Document Delivery 28-09-21pdf.exe	27
PID 1556 wrote to memory of 1668	1556	Document Delivery 28-09-21pdf.exe	27
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29
PID 1556 wrote to memory of 1856	1556	Document Delivery 28-09-21pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\Document Delivery 28-09-21pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Document Delivery 28-09-21pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EHTNmZh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D40.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\Document Delivery 28-09-21pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Document Delivery 28-09-21pdf.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1856