lokibot | f5c312f22d032b0ca6dba954815dd917765784c0a0c15569e96d4876bfd66e52

General

Target

UySfcAwQvKRAxLa.exe
Size

198KB
MD5

98661e5984ad7409b1652fa45267dc9c
SHA1

2369d074a8f5045166cfbf7e20ddcde5647df1e0
SHA256

f94e8615fb3b739ab3ad8ec81511b5439a72d4e865a5f9975aa524ac6036d3c2
SHA512

5875e0da29f6f5ab4ed7c6f6dfca1979c41413b97937227b8087d9503cbf19b0183a912a85b9995148d5968850527a7f5ba1e09dfdc09f965c97cc5e8c2b8eb0

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://broken6.cf/L3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

UySfcAwQvKRAxLa.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	UySfcAwQvKRAxLa.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	UySfcAwQvKRAxLa.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	UySfcAwQvKRAxLa.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

UySfcAwQvKRAxLa.exe

description pid process target process

PID 1756 set thread context of 2028 1756 UySfcAwQvKRAxLa.exe UySfcAwQvKRAxLa.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1712 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

UySfcAwQvKRAxLa.exe

pid process

1756 UySfcAwQvKRAxLa.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

UySfcAwQvKRAxLa.exe

pid process

2028 UySfcAwQvKRAxLa.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

UySfcAwQvKRAxLa.exeUySfcAwQvKRAxLa.exe

description pid process

Token: SeDebugPrivilege 1756 UySfcAwQvKRAxLa.exe
Token: SeDebugPrivilege 2028 UySfcAwQvKRAxLa.exe

description	pid	process	target process
PID 1756 set thread context of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe

pid	process
1712	schtasks.exe

pid	process
1756	UySfcAwQvKRAxLa.exe

pid	process
2028	UySfcAwQvKRAxLa.exe

description	pid	process
Token: SeDebugPrivilege	1756	UySfcAwQvKRAxLa.exe
Token: SeDebugPrivilege	2028	UySfcAwQvKRAxLa.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

UySfcAwQvKRAxLa.exe

description	pid	process	target process
PID 1756 wrote to memory of 1712	1756	UySfcAwQvKRAxLa.exe	schtasks.exe
PID 1756 wrote to memory of 1712	1756	UySfcAwQvKRAxLa.exe	schtasks.exe
PID 1756 wrote to memory of 1712	1756	UySfcAwQvKRAxLa.exe	schtasks.exe
PID 1756 wrote to memory of 1712	1756	UySfcAwQvKRAxLa.exe	schtasks.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe
PID 1756 wrote to memory of 2028	1756	UySfcAwQvKRAxLa.exe	UySfcAwQvKRAxLa.exe

outlook_office_path 1 IoCs

Processes:

UySfcAwQvKRAxLa.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	UySfcAwQvKRAxLa.exe

outlook_win_path 1 IoCs

Processes:

UySfcAwQvKRAxLa.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	UySfcAwQvKRAxLa.exe

C:\Users\Admin\AppData\Local\Temp\UySfcAwQvKRAxLa.exe
"C:\Users\Admin\AppData\Local\Temp\UySfcAwQvKRAxLa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JSdLEFRggUtcC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C54.tmp"
2⤵
- Creates scheduled task(s)
PID:1712

C:\Users\Admin\AppData\Local\Temp\UySfcAwQvKRAxLa.exe
"C:\Users\Admin\AppData\Local\Temp\UySfcAwQvKRAxLa.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5C54.tmp
Filesize
1KB

MD5
e7a9cfcb7fbdee5999716e5ce0a77055

SHA1
0ed9d78c25281b5068bdbaf88f692ad7ded54ddc

SHA256
b50a7ad9fddf670bcbe3bd9ed4d9f18ac82e92895e6b96900b241821a230ea63

SHA512
c8528d036543548d857c07813fc375b2196485129ab3a45abc620d9fb8ffc26d5c498b88429f927873aed489d4c1d4a4ef7dec8d8a0dca9196990ed371315537

Download Submit
memory/1712-56-0x0000000000000000-mapping.dmp

Download
memory/1756-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-58-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-67-0x00000000004139DE-mapping.dmp

Download
memory/2028-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2028-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads