Talos Lokibot Jan 2021

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

Lokibot has used process hollowing to inject itself into legitimate Windows process.

Lokibot has used PowerShell commands embedded inside batch scripts.

Lokibot has used cmd /c commands embedded within batch scripts.

Lokibot has used VBS scripts and XLS macros for execution.

Lokibot will delete its dropped files after bypassing UAC.

Lokibot has used HTTP for C2 communications.

Lokibot can search for specific files on an infected host.

Lokibot downloaded several staged items onto the victim's machine.

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.

Lokibot has modified the Registry as part of its UAC bypass process.

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.

Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.

Lokibot has performed a time-based anti-debug check before downloading its third stage.

Lokibot has utilized multiple techniques to bypass UAC.

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.

Lokibot has reflectively loaded the decoded DLL into memory.