lokibot | edddab090284f2bd22d4a30b9bbe352af5c0c357f72ab3d27154fdabf9fee51c

General

Target
548fceb4959384ed0351f1fcd4ef54e1.exe
Size 242KB
Sample220125-mavbnseac2
SHA256 edddab090284f2bd22d4a30b9bbe352af5c0c357f72ab3d27154fdabf9fee51c
MD5 548fceb4959384ed0351f1fcd4ef54e1
SHA1 bc22842642007645258fce92e108a9fe3456e21e
SHA512 b00458181d9253eec11227942abd32d145410e0695f01473b48569f675b9c93082d580d12f662faf8e13bff0f35fe0110d3ba7549eea1e8d1277d8123a5b88c8
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://hfjv9g950bag53fcbcdnbcbnmhy35zch.tk/BN1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Loads dropped DLL 1 IoCs

pid	Process
1844	548fceb4959384ed0351f1fcd4ef54e1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	548fceb4959384ed0351f1fcd4ef54e1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	548fceb4959384ed0351f1fcd4ef54e1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	548fceb4959384ed0351f1fcd4ef54e1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
744	548fceb4959384ed0351f1fcd4ef54e1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	548fceb4959384ed0351f1fcd4ef54e1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27
PID 1844 wrote to memory of 744	1844	548fceb4959384ed0351f1fcd4ef54e1.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	548fceb4959384ed0351f1fcd4ef54e1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	548fceb4959384ed0351f1fcd4ef54e1.exe

C:\Users\Admin\AppData\Local\Temp\548fceb4959384ed0351f1fcd4ef54e1.exe
"C:\Users\Admin\AppData\Local\Temp\548fceb4959384ed0351f1fcd4ef54e1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\548fceb4959384ed0351f1fcd4ef54e1.exe
  "C:\Users\Admin\AppData\Local\Temp\548fceb4959384ed0351f1fcd4ef54e1.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-55-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/744-57-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1844-53-0x0000000075341000-0x0000000075343000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads