lokibot | 4a07b3b4c08db64e0aa91b63b89bdf438814a5236de328efcb11fd9a78ed19bd

General

Target
1467b6a392e31fdf968a1d500089acfb.exe
Size 276KB
Sample211014-neb7bsghdm
SHA256 4a07b3b4c08db64e0aa91b63b89bdf438814a5236de328efcb11fd9a78ed19bd
MD5 1467b6a392e31fdf968a1d500089acfb
SHA1 85375bf2ab5d47386d7870cddd332e152ee8a28f
SHA512 5984eee018336725f99ae84a25016f2776f10c8619781083103c6d89f942589367f38ca558eb5fe88d7fe3bd4af93856b1e81ced8ef395ba6b44eb6cc5ac76c7
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://136.243.159.53/~element/page.php?id=501
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
672	1467b6a392e31fdf968a1d500089acfb.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	1467b6a392e31fdf968a1d500089acfb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	1467b6a392e31fdf968a1d500089acfb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	1467b6a392e31fdf968a1d500089acfb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3180	1467b6a392e31fdf968a1d500089acfb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	1467b6a392e31fdf968a1d500089acfb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73
PID 672 wrote to memory of 3180	672	1467b6a392e31fdf968a1d500089acfb.exe	73

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	1467b6a392e31fdf968a1d500089acfb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	1467b6a392e31fdf968a1d500089acfb.exe

C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb.exe
"C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb.exe
  "C:\Users\Admin\AppData\Local\Temp\1467b6a392e31fdf968a1d500089acfb.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-115-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3180-117-0x0000000000400000-0x00000000004A2000-memory.dmp