lokibot | 892b2599cfec3627557271febe1663f40297c6d30c1f31b83c4547b53473c574

General

Target
7d70799e55cbb78908bfa713bb48ac37.exe
Size 1.1MB
Sample220220-j55jcaade9
SHA256 892b2599cfec3627557271febe1663f40297c6d30c1f31b83c4547b53473c574
MD5 7d70799e55cbb78908bfa713bb48ac37
SHA1 76bb36702ddbccf80b1633b835b2c39d1afc5224
SHA512 94b0eaf36f7ab07e8431506742baff3a3f6a33ed094ea2c6990447de08aad053ab3e1d1036d47a7da3b8499e1c8810ff31692e6d952cb3bb32cbe688618d6aa8
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://kitnasedhasa.com/rud/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d70799e55cbb78908bfa713bb48ac37.exe	7d70799e55cbb78908bfa713bb48ac37.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d70799e55cbb78908bfa713bb48ac37.exe	7d70799e55cbb78908bfa713bb48ac37.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7d70799e55cbb78908bfa713bb48ac37.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7d70799e55cbb78908bfa713bb48ac37.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	7d70799e55cbb78908bfa713bb48ac37.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3004	7d70799e55cbb78908bfa713bb48ac37.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	7d70799e55cbb78908bfa713bb48ac37.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82
PID 1612 wrote to memory of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82
PID 1612 wrote to memory of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82
PID 1612 wrote to memory of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82
PID 1612 wrote to memory of 3004	1612	7d70799e55cbb78908bfa713bb48ac37.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	7d70799e55cbb78908bfa713bb48ac37.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	7d70799e55cbb78908bfa713bb48ac37.exe

C:\Users\Admin\AppData\Local\Temp\7d70799e55cbb78908bfa713bb48ac37.exe
"C:\Users\Admin\AppData\Local\Temp\7d70799e55cbb78908bfa713bb48ac37.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\7d70799e55cbb78908bfa713bb48ac37.exe
  "C:\Users\Admin\AppData\Local\Temp\7d70799e55cbb78908bfa713bb48ac37.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-130-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/3004-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3004-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads