lokibot | 911200cd3ee845071a445ed506b35eebdd1ee2df93697ef0f773e142070edbf2

General

Target
win32.exe
Size 313KB
Sample220331-jcc9dsgda6
SHA256 911200cd3ee845071a445ed506b35eebdd1ee2df93697ef0f773e142070edbf2
MD5 6033d817aa38339d88d4b5525fdccfa3
SHA1 64f70eda1b040d193493c3fbbed6571602b50376
SHA512 3bc07ccd143a59b9c5d60f84fd589dc3e71855b814cd4fb8e257651544adc3e165a73529ff3428ac2a0aba9cd908ea8688e965454523474f89ac9c358b58a4db
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gc23/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	win32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	win32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	win32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BDB08298-D99B-4555-88B2-438A3CE86670}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{22F9F770-374B-40B1-A62F-13943A9EC22F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003a25a398c6ecea94f59312f729bd7759841f4c9b7d621910360b416dba304694000000000e80000000020000200000009eda16128aadc6480b7f31231748e08c0a1e5f13c2c4bda9d13c422b11724c60100d0000970eb9bf058334f4ead1ac6393fd0a02e1f235a6588192019b9683c2083cd7f798732472be524e88da589f4361cbba575d053e7f71ab3aad12c050d1c93eae55f134ca23b724a1c810265706e26408ca7d2eb38edfe046463186633cb0eb3e9f70275e99c69c367d462a222da9377a4ff4e5018bf58367beade1236d54334036dd9fd5920444c05df55f564c78931e1d60e94dcdfdae7df99a95835c7e464b7c635b89ee565999b6e0cfab938c1311eaf6209d138b626d42ce910191d0d93fcdacd6311704f9511c6437a88c94143b62c19f17c1f688f55c4b55d456a0b35c21b892cf4dbb441659325f2bba378f1ca249c807f56b2055de62561c1d3a0fa3eb1d55865bfb2c3b8156ec3b6f285dd493a5bb84b9a9091c39316c669500d7d1e3e41678ab33fbc43156dc42dbbed42aa1e6bcca4c662c1d666c7a59a305b915067e6ac31fbd6892a665cc6e77de29bfead15c190ee525394ac2387254c1676e96eb951c7ce48ebed19168cbb2f9ba8a1158911f9e3c0592644ed605b7e66106b4573f6d3f247b1ef571c64ede5a6be0cb45b94390499118bbc04be242199ca3c03c466857f746d4c39b5f655f356a1b1798ad72198068ec074643b24d8d886f986dedf9a0549dfbb55e0f53d8a131fbe01ea8ebcc36d556055f8d77980f7f5bef4c388a5b4e66dab2a8674e9bbc354a001d48529563f8fc5ed54f0b2ece897c97bfb2ed6c71bc03f3953b7f022abb20bb3361465d3867c129f669623d55feeea55d7b49fe615399a380aad33c586ba37783329eee1d17c8400706cbe263d458348aab3281e0a136c876718cb2a74f32c883275ff8b0a6dda2e0656fcf5ed4336669bf7f278819e264f146998cb98a7fbb3fb208e930cd62250be06598815178fafef218964816b47ee317ca5ff19fd7c18788a1787c96466c788add9cc89da4526eab4f9ba8c0a641eaf9a7b02fa06922a3222b1b9abee9f9f7b2b8b9d30410cdcc6ec5ff73ff3c539052b2d6789a3146cdcf56dc297f84f98baf68ba0e93f6f27c705e577a70f2c120d7bd677bf2e638ff871b5f15a60fbfd700810a53ff553d480a1daced1ccf0f69041aa7750742dd1ab4e5d56ea662148e72b8f163790eb46bc4afd8c26acd34b231d2d764cf326f2cbdb571edc245ced07e331637a3a02672ebe4d2c65f04117f5ba9e5cf6458c8e046d11e2e9e2c83280bb5fe6ee0e032f5617bd033de57434e7061616ee2b22a007039283619efd0c24c26da01ed665166b4fec116e442a487921f10bec81d677d42447cb87aa031cce0d79f160f4c448abfc06926d1e2fc39b7beedca43134fceb9fee138a4c218212009a4ccf4bb190b0621af9113d76ff06ebedc7ec4db97dcc61423d1f2495198cf70bb33b97a2b0e9d25522658885801b9753fa2f503d45ee1a302b2f88ed60eeb185febf0b5f799c3b4892883847acd750d5830daff72c1d2d1d985125aa2b2c109a6182d18ed579963bf1fb55e74a7f822db13fbdbb02e58bbee22eb08b5136f9644cad332f209743b1095c147a13ca7b187efcc14f11f1c13987cbb3ce1be34813c46dbd5fe25cf6110ffecf3338f97094a1340e81765714bd19305c77d94dbb16270ec30af0de57992c25d9e65cfd77a689daeabe0d429b080275f7b552ffa353100ff6ea3be216bcdbf06a842585504b5fa8ce6882f4749c9135b1556252e00536c6fc7714e9bb6be9f2901c554751ec37a4e4569831eb98374dac32467333ddd2f09fdb5ae0cf1c0d93f0a1a7758e6996fe6750b0184bb22dead7ec5149ea40aa3831c80d4ca89a794373956eb192cc8651bdde667f70983712770f2ddf9aa7f413d027e55f4ebae3328cafbe9cad12d4823b3b1c5a709f0d3f72ef3a1a0098fe542f718125fb8408c4228e4822e1fd7766f25bc31cbe311f634030728ba1fc08cb54d1df9101fce6b3372a035178c0e8be8ab40c71baf1f62c4c0dbd4beedf3d0d8a32853aedf8b0969d496a512f9eec91a6c0e8e462d07f150026225914f6c3eee1cfb6bcbcd3fd8cdb40b2a6fe409d6b39cbb35033a452fbdff19576a211181d3d7fb956f781e24abe2cc5ad1fe1616f712007dd9266d4159e3c00973fdb46c3af1735bdd87f98046d6475e115ed529896071e01c4c9c4c3cf5b5d5b2fb5e9ccc6fd411863e68b10869f992e839704dbc384c81b4ba65c3f3247e3b042a717412f7150a4835057468d7c06d96e927879028a37947dd996321b9bb2aa904c4b27448484950ae8ee0dc626cbeb99c151658a28b006e8e0a0190998b968e08b4d25bed344a87a94f4328a13cec899c1bd8bfdc09a301f0a2b7f62f986a0d7185851da5f78d2a5eed4d18e79418b8fb5aa63ffa3e17f92e515a6f5eda99bb5bdd8d4dfe97547875aad28afdc615522f69fa54ab1364c1db82058824870db863f76d913a7c4f46d0c5e49b82a5cb37f1caa0ae55eff29ff428d8da23fb5d2ca6b65009cf7af495c7b5e308357164680479ce2bab3e1961c798ab2fa478fca463d713534454e56337195ac1909ce9523be0149cce56cb15b144e7c09856ffe7504004968cb4791430b41a8c069f9bdccd856140b1d2242e9e94992b0700d25ecd2b45691c7fb8ac4c029d23bab5539abf065295e16cf88b028ce533104c37fbbd224a1e461b9da76887f02a1bb07a1f90b5211fb7d0aeebea829a4d8d8b253107e9e5023ec89473313099d614050aa90b5ef0ab1efada646a173f60dea0b7a91234379330a782ddc689e7b10d7ac0a359e895939bc517a1f3d0a744ad631c546748f606f84c3a6694200cef64eb1bcd88bb13736ae4cd6e2eb867eac2b4594be35d284303cca61691713b602a78d4d055886e7bbfd27756a281bb5be71de5714b69af034293d835a350bb9742881f8f054b3899cb67bd9685f5e590a1f3fa194f3d0c41e21b04f868a2dfeeb87937629aec9987f59ce8425c9f5ae08f1547ff81797c348323c89f5475a5db2a66d8f80c771f68b9ef23dc4d47e761456e22fcfc7e17a2d4b74fa5036c4aa9126468882c88bb8e5c54e3d0f773b8f6c23cf02b08913badf949618688e356af010b5ae2ed89c7055abe32c73b26829eb357908f42b890fcda63a5e5064cbf4e0179ad362c20662976ab0730f0925729ead0c2019ca2bb4fe66dbca1ec3644c79e90cccfcb4b82620448b8d7e33321faf9538610fad5529acc8cf44becfc4d768d253cfb5f5928b24197e0cba80783dbe64110afa915eab19fb0d9c4cb0e0ef6485ad74d8f4fc3adc6041ec755d846032d39dbad01ac1ef8c43a2d76d2fb576da6caf09ce8b05b130d543d9da0d2ec83bbac1a9d2814fa097e26202425b63794dc4f597a4bbb03a8da46ab8ac9ec475cd14992374d4cd4294ad6912dc602fa09cb4091c6b823b40ad6860a83ae90960089aef3643480a3ca2a067689dbab7c2967d862a96f2d4a1037fc76d5abb36043055c97e8cfa6fc40ee3ea108a9b6be0e549e6db81296b7820889f934b461fbb18eb0d15bde16a6d892baef82a94ac00df3006b266140612bc45d5a3933f910195b7e44fc8ac73a0bc519cb4fbe31b237e50262e36d9a18a521d182f8438a6e00c876c0b5457c9f42b884d883433611071fef0191a146b68f3d9bcca246105240ba38b2f2c5cdc301f098b6bff3f9889b339060b8a54d3f23ad268f7bad7c39155e7c7969a4162352e32f23232a92bc897985a68d913691b3ccc2832e26e282224422d9871e6d16cc977bc4a163c86cef66822b9c74959d3441117f4126d832b525363b1a1a70fcbeefe46e96e3ce99a2d3a737d23adbc86b5bda65c8f14bca7ac93effa0cacdbcb7661e19acd60abca42671964e0f16202a5628d368e584dcd508fc63bdfdb49ebac67e1dd21b696efd79b689a67f16f2b5c7e7fac4974a7e20efeaaea8eaf9e24c1aa1438d87c22c7a2f1d5f07124364bfffb8a1667a8113b7f06f06aeb3507daab4887db548a7fc41282581ac16e67803052e4c09b02dc615db23eb7bb806994411ca18b59d431180003d86d3d2bb669c3e71e4059f3261d48c5259fed2b6110aa56e76ab256c57259e173c6f06a4b9e18a1ef99c23edab5c4e501da8397052d34e867aa1a015c04c0f6506b1378656e4f60c999864d55af1c3cfb821466e6d7e4a1894532b3363c1fc253c2193dc236a5a48bc3992157096aeb50189946a82de692bb2defff4bfae7f1d9e34e769ce85baf6b34ea847b78c39924a8bc613d8335d55d4ba795d681a15ea565f1cfe10481512fce54f12b006414c10f337a5cf2a09990131aa3ef26e6da36c533effa3322cfa4b7b2c968bd48b59cfd3bc1640bf2cbdd056d60dc7156e6fc2fd0d7827ec1ce44c12f46ef4f159ffa2d4310b11ef511003a61d9145af8f828f3f73b413d5766db88809758ba31209a0f70aa5d62d301987cdb83f2e67f8c8defa60a49d3312c19bab2264f88abd1098927541c46f63b8fec65e37d92bcb2b387e2a82166d6a18b2bd9ad514884e3a2a1152727f563da5bd5772c15e27af4660c6b833015d73ef1b2a3f3fe1ca09d8f10d17950ba3b95b85b0f8053a49eb66f7d301f1a72e4b5111c68d2cc9ddd338b7554f5fec4f38825ce27a1b76caf13d537580114b44de001f653b04f45a93df2fbd3116d7b7d91e8b48348469f40b420bd7b69db430074faf38508e62b9dc19f05792f5d6a0504a2a89f0ec5080656b4ef4315a7de8ff1940000000f059e4424d7e591f7190250ce5ef50f090f3c8e28fb7f1f1f71d069cb7e898e88473f9f3df979a6199c0e49a5fa0a16f629f1281b6483a2bd371b72b099f0e3a	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006C715567F"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006C715567F = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003d3e489d4fae7a53393e990b80906faf587229009205731e33ceb7b94ab7cf78000000000e8000000002000020000000d29993a047ff5ecc4b63f5440230c33a617f15e53d75afc44e99bd03620fecff8000000064789d805e694929bb49a88042aaeabe73d7319150c8213dae134ea10866cef57c4a62f1071ad506f11cc74d481d8cabd2692bcd273aa491c8864f23be3673e8d4f1c712afa27526e8f5528b08e76bff80b90d635677089b165edbe7c8df79671dcb467bf42bf20ead3b59a03e701d6b75132ad26b350e1538af03e02130c929400000003e24a683019f21e762fbb1f1d7b102f85bb95d251ea33e531277e6a9a5012043c697518c2991d31c72da7f3d5985e7ccdd6630b0195b89046cc625dead7482a6	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3632	win32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3632	win32.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	win32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	win32.exe

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3380

C:\Users\Admin\AppData\Local\Temp\win32.exe
"C:\Users\Admin\AppData\Local\Temp\win32.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-134-0x000000000073D000-0x000000000074C000-memory.dmp

Download

memory/3632-135-0x000000000073D000-0x000000000074C000-memory.dmp

Download

memory/3632-136-0x00000000005F0000-0x000000000060B000-memory.dmp

Download

memory/3632-137-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads