lokibot | 950afdfc712687ef06676b890a73936fecf980e947f9f2f0d36ea89dc6b3f40c

General

Target
63abc322179aedf5374fa531f6664371.exe
Size 210KB
Sample200701-8953dgzyv2
SHA256 950afdfc712687ef06676b890a73936fecf980e947f9f2f0d36ea89dc6b3f40c
MD5 63abc322179aedf5374fa531f6664371
SHA1 f5956ffe42d261c8da88f04968b43d3d041a17e8
SHA512 359553609196a611b69e1e63d7c7426566bba63e230acbbb32643621af385cfe164788dc46acb06ba0b1fbdbe334b2343f4483e11338bb1888580f871edc0aa2
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://46.21.147.175/FtgPlac/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	63abc322179aedf5374fa531f6664371.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	63abc322179aedf5374fa531f6664371.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	63abc322179aedf5374fa531f6664371.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68
PID 3100 wrote to memory of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 3368	3100	63abc322179aedf5374fa531f6664371.exe	68

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3368	63abc322179aedf5374fa531f6664371.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	63abc322179aedf5374fa531f6664371.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	63abc322179aedf5374fa531f6664371.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	63abc322179aedf5374fa531f6664371.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	63abc322179aedf5374fa531f6664371.exe

C:\Users\Admin\AppData\Local\Temp\63abc322179aedf5374fa531f6664371.exe
"C:\Users\Admin\AppData\Local\Temp\63abc322179aedf5374fa531f6664371.exe"
1⤵
- Checks BIOS information in registry
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Looks for VirtualBox Guest Additions in registry
- Maps connected drives based on registry
PID:3100
- C:\Users\Admin\AppData\Local\Temp\63abc322179aedf5374fa531f6664371.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3368