lokibot | 06384ff303fadeb1b7f8a3eb85b996cdb4e738f30397e927da65204649056e8d

General

Target
4ce4d3e6cf1a6bee19ff804132c7d8fe.exe
Size 209KB
Sample200701-v7gd212286
SHA256 06384ff303fadeb1b7f8a3eb85b996cdb4e738f30397e927da65204649056e8d
MD5 4ce4d3e6cf1a6bee19ff804132c7d8fe
SHA1 b485a21fdfe31888224de5d821c7d6b6179d57f1
SHA512 e61c6f73b7db1c85790515e4331c23035a6c0379119f5a9d247172f10c552b94a69906c1bf6f33301d88970afb3fbc73d9e117ca4a84c0d85d962f5c03d83e7c
MD5 SHA1 SHA512

Score

10^/10

spyware trojan stealer lokibot

Malware Config

Extracted

Family

lokibot

C2

http://46.21.147.175/FtgPlac/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73
PID 2536 wrote to memory of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3696	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 3696	2536	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe	73

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	4ce4d3e6cf1a6bee19ff804132c7d8fe.exe

C:\Users\Admin\AppData\Local\Temp\4ce4d3e6cf1a6bee19ff804132c7d8fe.exe
"C:\Users\Admin\AppData\Local\Temp\4ce4d3e6cf1a6bee19ff804132c7d8fe.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
- Looks for VMWare Tools registry key
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
PID:2536
- C:\Users\Admin\AppData\Local\Temp\4ce4d3e6cf1a6bee19ff804132c7d8fe.exe
  "{path}"
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3696