lokibot | b2716ac6169dc9ab6107117a9f88e4e30b1dd8cf7563f26cfec15ed3ee0fd2e0

General

Target

Pago Factura.xls
Size

160KB
MD5

03b1061e0a0cdf717e60708f1051d156
SHA1

2c3a07752cb73e1b0bd80f2b6554f0ec4bed2ba8
SHA256

b2716ac6169dc9ab6107117a9f88e4e30b1dd8cf7563f26cfec15ed3ee0fd2e0
SHA512

98129c7d88a3f079595846d3e00eac3d7f6b7e35151f1dd80d4e31b1290fc6dee88129f53e903b3956be3ac69606d696c86ee540f654d7b72701d2744bdcd3fd

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://46.21.147.175/FtgPlac/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1628 EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

EXCEL.EXEcssrs.exe

description	pid	process	target process
PID 1628 wrote to memory of 1652	1628	EXCEL.EXE	cssrs.exe
PID 1628 wrote to memory of 1652	1628	EXCEL.EXE	cssrs.exe
PID 1628 wrote to memory of 1652	1628	EXCEL.EXE	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe
PID 1652 wrote to memory of 1396	1652	cssrs.exe	cssrs.exe

Executes dropped EXE 2 IoCs

Processes:

cssrs.execssrs.exe

pid process

1652 cssrs.exe
1396 cssrs.exe

pid	process
1652	cssrs.exe
1396	cssrs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cssrs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cssrs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cssrs.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE
1628	EXCEL.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

cssrs.exe

description pid process target process

PID 1652 set thread context of 1396 1652 cssrs.exe cssrs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cssrs.exe

description pid process

Token: SeDebugPrivilege 1396 cssrs.exe

description	pid	process	target process
PID 1652 set thread context of 1396	1652	cssrs.exe	cssrs.exe

description	pid	process
Token: SeDebugPrivilege	1396	cssrs.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cssrs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cssrs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cssrs.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

cssrs.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions cssrs.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

cssrs.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools cssrs.exe
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	cssrs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	cssrs.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pago Factura.xls"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Users\Admin\AppData\Roaming\cssrs.exe
"C:\Users\Admin\AppData\Roaming\cssrs.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Checks BIOS information in registry
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
PID:1652

C:\Users\Admin\AppData\Roaming\cssrs.exe
"{path}"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

6

T1012

System Information Discovery

6

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cssrs.exe

Download Submit
C:\Users\Admin\AppData\Roaming\cssrs.exe

Download Submit
C:\Users\Admin\AppData\Roaming\cssrs.exe

Download Submit
memory/1396-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1396-9-0x00000000004139DE-mapping.dmp

Download
memory/1396-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1628-4-0x000002575EA34000-0x000002575EA9A000-memory.dmp

Filesize
408KB

Download
memory/1652-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads