lokibot | 2bf70799e4cc807cd62fe8d7cbda8b12d1e089441120fe02411b84bc2b760c78

General

Target
MS-15.exe
Size 718KB
Sample220421-qaccmsecc4
SHA256 2bf70799e4cc807cd62fe8d7cbda8b12d1e089441120fe02411b84bc2b760c78
MD5 9faeff6d24d9cf06b81ecac12519b5b7
SHA1 2b605648c9463384fbe2603874bfbc0f21aca093
SHA512 6b0f420fbc1f38a1a76886a3f318514b24975607aaee81bc465998ce503128a4760f6e5f3eb61e38154f2045e0212fc09b4e35cd43d521fea3335fec92285efe
MD5 SHA1 SHA512

Score

10^/10

lokibot collection evasion spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=7347525472263042
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MS-15.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MS-15.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ByteCodeGenerator.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ByteCodeGenerator.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ByteCodeGenerator.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	MS-15.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	MS-15.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 4748	2908	MS-15.exe	80

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe
2908	MS-15.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	MS-15.exe
Token: SeDebugPrivilege	4748	ByteCodeGenerator.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3096	2908	MS-15.exe	79
PID 2908 wrote to memory of 3096	2908	MS-15.exe	79
PID 2908 wrote to memory of 3096	2908	MS-15.exe	79
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80
PID 2908 wrote to memory of 4748	2908	MS-15.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ByteCodeGenerator.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ByteCodeGenerator.exe

C:\Users\Admin\AppData\Local\Temp\MS-15.exe
"C:\Users\Admin\AppData\Local\Temp\MS-15.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\choice.exe
  "C:\Windows\SysWOW64\choice.exe"
  2⤵
  PID:3096
- C:\Windows\SysWOW64\ByteCodeGenerator.exe
  "C:\Windows\SysWOW64\ByteCodeGenerator.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-130-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2908-131-0x00000000054D0000-0x0000000005A74000-memory.dmp

Download

memory/2908-132-0x0000000004F20000-0x0000000004FBC000-memory.dmp

Download

memory/2908-133-0x0000000004FC0000-0x0000000005052000-memory.dmp

Download

memory/2908-134-0x0000000004E60000-0x0000000004E6A000-memory.dmp

Download

memory/2908-135-0x0000000006D20000-0x0000000006D86000-memory.dmp

Download

memory/4748-138-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4748-140-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4748-141-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads