lokibot | 08251a10cbdda0388e4b22db9e060e996d505082c786469b4e0ee85350fdc8cf

General

Target
21038315RI0007903596242.pdf.gz.exe
Size 374KB
Sample211008-gak54sdce4
SHA256 08251a10cbdda0388e4b22db9e060e996d505082c786469b4e0ee85350fdc8cf
MD5 77e721db501f94bbcbda5a9924741a0d
SHA1 3f492937ae696cbbb086a3319a40ca7dca5a93ec
SHA512 f33600a9ff9be5ca739107f8afac316b7b2656e54b2104f7a6d62c5eddbf70c4bf4c35960e4a3422103fe9bccad054e9343c4a53a81c6f2f2d480b905be1af06
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	21038315RI0007903596242.pdf.gz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	21038315RI0007903596242.pdf.gz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	21038315RI0007903596242.pdf.gz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	21038315RI0007903596242.pdf.gz.exe
4060	21038315RI0007903596242.pdf.gz.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1208	21038315RI0007903596242.pdf.gz.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	21038315RI0007903596242.pdf.gz.exe
Token: SeDebugPrivilege	1208	21038315RI0007903596242.pdf.gz.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2376	4060	21038315RI0007903596242.pdf.gz.exe	76
PID 4060 wrote to memory of 2376	4060	21038315RI0007903596242.pdf.gz.exe	76
PID 4060 wrote to memory of 2376	4060	21038315RI0007903596242.pdf.gz.exe	76
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78
PID 4060 wrote to memory of 1208	4060	21038315RI0007903596242.pdf.gz.exe	78

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	21038315RI0007903596242.pdf.gz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	21038315RI0007903596242.pdf.gz.exe

C:\Users\Admin\AppData\Local\Temp\21038315RI0007903596242.pdf.gz.exe
"C:\Users\Admin\AppData\Local\Temp\21038315RI0007903596242.pdf.gz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\faXCTbr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDDC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\21038315RI0007903596242.pdf.gz.exe
  "C:\Users\Admin\AppData\Local\Temp\21038315RI0007903596242.pdf.gz.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1208