lokibot | ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488

Analysis

max time kernel
4294185s
max time network
129s
platform
windows7_x64
resource
win7-20220311-en
submitted
31/03/2022, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c83c2fac1fda57a7bccf27738cb14c6.exe
Size 231KB
Sample220331-l58bcaabf7
SHA256 ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488
MD5 7c83c2fac1fda57a7bccf27738cb14c6
SHA1 d4880b6316cce56bda61040d11c51f242ec215f5
SHA512 7c94d62faf55f97b27fab34b18c362af2f805a133b11635dc836bb226526372e089ef916607016f34e9a0f506898f133aab16015d451f73e4dd66b233ca7e068
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://62.197.136.176/userbob/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
960	aytayrxctk.exe
616	aytayrxctk.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	7c83c2fac1fda57a7bccf27738cb14c6.exe
960	aytayrxctk.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aytayrxctk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aytayrxctk.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aytayrxctk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 616	960	aytayrxctk.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	aytayrxctk.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 960	1736	7c83c2fac1fda57a7bccf27738cb14c6.exe	27
PID 1736 wrote to memory of 960	1736	7c83c2fac1fda57a7bccf27738cb14c6.exe	27
PID 1736 wrote to memory of 960	1736	7c83c2fac1fda57a7bccf27738cb14c6.exe	27
PID 1736 wrote to memory of 960	1736	7c83c2fac1fda57a7bccf27738cb14c6.exe	27
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28
PID 960 wrote to memory of 616	960	aytayrxctk.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aytayrxctk.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aytayrxctk.exe

C:\Users\Admin\AppData\Local\Temp\7c83c2fac1fda57a7bccf27738cb14c6.exe
"C:\Users\Admin\AppData\Local\Temp\7c83c2fac1fda57a7bccf27738cb14c6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
  C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe C:\Users\Admin\AppData\Local\Temp\tmjzady
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
    C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe C:\Users\Admin\AppData\Local\Temp\tmjzady
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytayrxctk.exe

Path C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

aytayrxctk.exe

Path C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

aytayrxctk.exe

Path C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

tmjzady

Path C:\Users\Admin\AppData\Local\Temp\tmjzady
Size 4KB
SHA256 32456aa376176e00d5ecc0d4466538dcaa255db1ae2009df61db869c21c79e0b
MD5 a2ec54382906856e2ebac91d212437a0
SHA1 2b892af9b7b6971e690af5305f8e530fa9b719a7
SHA512 0df55b389ba41b953936479d8244e055535d0f288d648ef3521aedea2801757b55468350d4cb2f408417dfefaf81c244cf29d891f3fbcfd0991ce564f128b923
MD5 SHA1 SHA512

Submit Download

x6tmn3wfpq08dqaz

Path C:\Users\Admin\AppData\Local\Temp\x6tmn3wfpq08dqaz
Size 211KB
SHA256 2f6337f26e1239398c6fc6ece9b4b02301e04a91ca0586bdc561d89c94b66d3a
MD5 7c5163e74bb8e436a9f021db334b94d8
SHA1 3c095050aeccd43bbb8789fa324eb26986bf928b
SHA512 bbe1ce5e8675bf46d5ee4e0d0a5c2c43f89eff0673cda956d3cac28f2ddc9cb811f1383cc1be2b3d3308b3cf7e02a49581a057dd884ea2ff8ad0ab614b27ba1d
MD5 SHA1 SHA512

Submit Download

aytayrxctk.exe

Path \Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

aytayrxctk.exe

Path \Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

memory/616-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/616-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1736-54-0x00000000749A1000-0x00000000749A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads