lokibot | 100b9e476422fa4b4215e8885df624835e95ff67365770eb9c3bc3352630d211

General

Target
vbc.exe
Size 285KB
Sample211129-xnnq6affd2
SHA256 100b9e476422fa4b4215e8885df624835e95ff67365770eb9c3bc3352630d211
MD5 6c614905d13e5e2374169301b30a7088
SHA1 59760e472a531b67c0ab31a2e9bb16c6742e54de
SHA512 ca5e276f1de96afdfda786cc3a1c5be6b93b01448c8bf045b60933651f08c1d5613202dedd433ba556ef7e3f8ad9dc58aeaab9963893956f3211e6830c2f1c17
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
2848	vbc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 1280	2848	vbc.exe	69

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69
PID 2848 wrote to memory of 1280	2848	vbc.exe	69

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe