lokibot | 07ee89d7e9f665215c8cb4bb5290b358fe59d33231b7ede4a3cb415afb928054

General

Target
b331396c8641bfd6b5cf52e5a45177d2.exe
Size 241KB
Sample220124-japveadeg3
SHA256 07ee89d7e9f665215c8cb4bb5290b358fe59d33231b7ede4a3cb415afb928054
MD5 b331396c8641bfd6b5cf52e5a45177d2
SHA1 58e635f44e19620c70c7d77aa5cebe49038495f0
SHA512 ece5e73a0545030b65904abbbfa12fc7eb7d2725ecb707b5d619b17d65176be1c3a5bc2a25134aa5904c961c6a318f170f0f69b99bc5dddcf31aa20f5f090655
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gc7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
960	b331396c8641bfd6b5cf52e5a45177d2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b331396c8641bfd6b5cf52e5a45177d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b331396c8641bfd6b5cf52e5a45177d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b331396c8641bfd6b5cf52e5a45177d2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1352	b331396c8641bfd6b5cf52e5a45177d2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	b331396c8641bfd6b5cf52e5a45177d2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27
PID 960 wrote to memory of 1352	960	b331396c8641bfd6b5cf52e5a45177d2.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b331396c8641bfd6b5cf52e5a45177d2.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b331396c8641bfd6b5cf52e5a45177d2.exe

C:\Users\Admin\AppData\Local\Temp\b331396c8641bfd6b5cf52e5a45177d2.exe
"C:\Users\Admin\AppData\Local\Temp\b331396c8641bfd6b5cf52e5a45177d2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\b331396c8641bfd6b5cf52e5a45177d2.exe
  "C:\Users\Admin\AppData\Local\Temp\b331396c8641bfd6b5cf52e5a45177d2.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1352-56-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1352-58-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads