lokibot | 81ed0bde4f59ed3f28745d29e08cdea0bb9f096662476710f910173fc6376311

General

Target

Swift Doc.exe
Size

281KB
MD5

6d5dbefe732e62fb5164fead6af6a887
SHA1

b3f19fa125a3e4f418a287f63f6b85e751c43396
SHA256

ca9be111c1e10b81ab16b5434474f09085c62d8d592fce7e79810aef284a675e
SHA512

d5ef89ccdc6db1898364243bc07771e442f5cc69518ea6f256706e7603d72cb813ec466fac23dd76c4ecde4072d82c9a60c89e1d9985c064780549aa2a242fed

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://beckhoff-th.com/kon/kon2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Swift Doc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Swift Doc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Swift Doc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Swift Doc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Swift Doc.exe

description pid process target process

PID 1452 set thread context of 1820 1452 Swift Doc.exe Swift Doc.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Swift Doc.exe

pid process

1820 Swift Doc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Swift Doc.exe

description pid process

Token: SeDebugPrivilege 1820 Swift Doc.exe

description	pid	process	target process
PID 1452 set thread context of 1820	1452	Swift Doc.exe	Swift Doc.exe

pid	process
1820	Swift Doc.exe

description	pid	process
Token: SeDebugPrivilege	1820	Swift Doc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Swift Doc.exe

description	pid	process	target process
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe
PID 1452 wrote to memory of 1820	1452	Swift Doc.exe	Swift Doc.exe

outlook_office_path 1 IoCs

Processes:

Swift Doc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Swift Doc.exe

outlook_win_path 1 IoCs

Processes:

Swift Doc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Swift Doc.exe

C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\Swift Doc.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-54-0x0000000000FA0000-0x0000000000FEC000-memory.dmp

Filesize
304KB

Download
memory/1452-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/1452-57-0x0000000000510000-0x0000000000538000-memory.dmp

Filesize
160KB

Download
memory/1820-58-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-67-0x00000000004139DE-mapping.dmp

Download
memory/1820-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads