lokibot | fc38d73c4dd651a49817f58fe70cf00fca3b3e4b3c1c062c4fa816cb1d95565c

General

Target

EA #44366209.docx
Size

10KB
MD5

9896dc7905c49361f0eb7185585d81a9
SHA1

2378ab96106c968c587f2ab85cf24fd57d040afd
SHA256

fc38d73c4dd651a49817f58fe70cf00fca3b3e4b3c1c062c4fa816cb1d95565c
SHA512

84204157fc9e66fea5684e53b9ee8cc09ea043099575136ddf2417eec9c4fda1634879bc3770771a671c682b65cd8b9a092b838e55c05c42fb7ba79ed8a49703

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://173.208.204.37/k.php/mvM4bZPtu0I2s

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

10 816 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

vbc.exevbc.exe

pid process

404 vbc.exe
292 vbc.exe

flow	pid	process
10	816	EQNEDT32.EXE

pid	process
404	vbc.exe
292	vbc.exe

Abuses OpenXML format to download file from external location 2 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Office\Common\Offline\Files\http://kabaka.ddns.net/udara/a.wbk	WINWORD.EXE

Loads dropped DLL 4 IoCs

Processes:

EQNEDT32.EXE

pid process

816 EQNEDT32.EXE
816 EQNEDT32.EXE
816 EQNEDT32.EXE
816 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 404 set thread context of 292 404 vbc.exe vbc.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

816 EQNEDT32.EXE

pid	process
816	EQNEDT32.EXE
816	EQNEDT32.EXE
816	EQNEDT32.EXE
816	EQNEDT32.EXE

description	pid	process	target process
PID 404 set thread context of 292	404	vbc.exe	vbc.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
816	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1664 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 292 vbc.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1664 WINWORD.EXE
1664 WINWORD.EXE

pid	process
1664	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	292	vbc.exe

pid	process
1664	WINWORD.EXE
1664	WINWORD.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEvbc.exe

description	pid	process	target process
PID 816 wrote to memory of 404	816	EQNEDT32.EXE	vbc.exe
PID 816 wrote to memory of 404	816	EQNEDT32.EXE	vbc.exe
PID 816 wrote to memory of 404	816	EQNEDT32.EXE	vbc.exe
PID 816 wrote to memory of 404	816	EQNEDT32.EXE	vbc.exe
PID 1664 wrote to memory of 896	1664	WINWORD.EXE	splwow64.exe
PID 1664 wrote to memory of 896	1664	WINWORD.EXE	splwow64.exe
PID 1664 wrote to memory of 896	1664	WINWORD.EXE	splwow64.exe
PID 1664 wrote to memory of 896	1664	WINWORD.EXE	splwow64.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe
PID 404 wrote to memory of 292	404	vbc.exe	vbc.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EA #44366209.docx"
1⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:896

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:816

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
C:\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
C:\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
\Users\Public\vbc.exe
MD5
235651dacc6b7bc11c95cdecb467799e

SHA1
84b51f798de3f67980a9dd954f32b1291446de32

SHA256
95969df63a2c9f6555b4e36496188454606d5999c3f2a3c8fd44ad5a84cf8cb5

SHA512
4b3ff59168af9b4e77e323a55d3f1340f6f0b42091eb00f66bd3229882568db9158bf0e98accb477878ef0190bdd8571f93038ae20391b39f9b4b3e452e436ee

Download Submit
memory/292-82-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/292-78-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/292-79-0x00000000004139DE-mapping.dmp

Download
memory/404-77-0x0000000000890000-0x00000000008B4000-memory.dmp

Filesize
144KB

Download
memory/404-70-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/404-67-0x0000000000000000-mapping.dmp

Download
memory/404-74-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/404-75-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download
memory/404-76-0x0000000004E70000-0x0000000004ED8000-memory.dmp

Filesize
416KB

Download
memory/816-62-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/896-73-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/896-72-0x0000000000000000-mapping.dmp

Download
memory/1664-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1664-60-0x000000006FC31000-0x000000006FC33000-memory.dmp

Filesize
8KB

Download
memory/1664-59-0x00000000721B1000-0x00000000721B4000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads