lokibot | 1f105502087993709840bc30bc022d2d5b54e4db4351435e44034e26a4d48fbb

General

Target
a4c13722c598f133907c003dd0672743.exe
Size 284KB
Sample220118-v4a4wsccb7
SHA256 1f105502087993709840bc30bc022d2d5b54e4db4351435e44034e26a4d48fbb
MD5 a4c13722c598f133907c003dd0672743
SHA1 6f44e1db3afc092e60c1378c28f3b9578dbc4308
SHA512 2bb68a0207f2a442d3ea1e5edd18f6034fc0913515cf888c8bbfc20f7aca03d76595f770d8b261ef9e72c44dd63b572c8f843a34e5b8738d20a03d17de8ebd50
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gc7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
3248	a4c13722c598f133907c003dd0672743.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a4c13722c598f133907c003dd0672743.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	a4c13722c598f133907c003dd0672743.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	a4c13722c598f133907c003dd0672743.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3248 set thread context of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3488	a4c13722c598f133907c003dd0672743.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	a4c13722c598f133907c003dd0672743.exe
Token: SeSystemtimePrivilege	1868	svchost.exe
Token: SeSystemtimePrivilege	1868	svchost.exe
Token: SeIncBasePriorityPrivilege	1868	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51
PID 3248 wrote to memory of 3488	3248	a4c13722c598f133907c003dd0672743.exe	51

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	a4c13722c598f133907c003dd0672743.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	a4c13722c598f133907c003dd0672743.exe

C:\Users\Admin\AppData\Local\Temp\a4c13722c598f133907c003dd0672743.exe
"C:\Users\Admin\AppData\Local\Temp\a4c13722c598f133907c003dd0672743.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\a4c13722c598f133907c003dd0672743.exe
  "C:\Users\Admin\AppData\Local\Temp\a4c13722c598f133907c003dd0672743.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3488-132-0x0000000000400000-0x00000000004A2000-memory.dmp