lokibot | 716cef6988e3d7cc2a4bbcc7140995c280a23b2e6b54824eac031fdb4905be9b

General

Target
8723945514e37b6d2b8f7db46a09ce82.exe
Size 682KB
Sample220411-x53awaced3
SHA256 716cef6988e3d7cc2a4bbcc7140995c280a23b2e6b54824eac031fdb4905be9b
MD5 8723945514e37b6d2b8f7db46a09ce82
SHA1 c7bf424347e32f147920933f5bfaf62fd2c94459
SHA512 e933c1ec6b2c60896013a90bbef3146b2b1623af910f7f00e3e954d2db8ab4ed86b2d5f010ca72affc7daa7f20b7e3c3aa541c433bd1570b22df5664e04a7393
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://45.133.1.45/me/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8723945514e37b6d2b8f7db46a09ce82.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	8723945514e37b6d2b8f7db46a09ce82.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	8723945514e37b6d2b8f7db46a09ce82.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4500	8723945514e37b6d2b8f7db46a09ce82.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	8723945514e37b6d2b8f7db46a09ce82.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86
PID 4336 wrote to memory of 4500	4336	8723945514e37b6d2b8f7db46a09ce82.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	8723945514e37b6d2b8f7db46a09ce82.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8723945514e37b6d2b8f7db46a09ce82.exe

C:\Users\Admin\AppData\Local\Temp\8723945514e37b6d2b8f7db46a09ce82.exe
"C:\Users\Admin\AppData\Local\Temp\8723945514e37b6d2b8f7db46a09ce82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\8723945514e37b6d2b8f7db46a09ce82.exe
  "C:\Users\Admin\AppData\Local\Temp\8723945514e37b6d2b8f7db46a09ce82.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-124-0x0000000000330000-0x00000000003E0000-memory.dmp

Download

memory/4336-125-0x00000000052A0000-0x0000000005844000-memory.dmp

Download

memory/4336-126-0x0000000004D90000-0x0000000004E22000-memory.dmp

Download

memory/4336-127-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Download

memory/4336-128-0x0000000007330000-0x00000000073CC000-memory.dmp

Download

memory/4336-129-0x0000000007670000-0x00000000076D6000-memory.dmp

Download

memory/4500-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4500-133-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads