lokibot | 736c545dcb8c8d206c1232748ac9c9f926c05bda439459291c768bffb2f7dca4

General

Target

invoice.exe
Size

649KB
MD5

cc08a2eddba277c07eeaf45dee305523
SHA1

429c2f58d016c45d74a7ca4599ec4f5918a2cfbb
SHA256

b0b7794c7dcb401dd9cf7e14d6b95af37421de550f6990260ce83c674ea38512
SHA512

8ff53d89ca5fcd1ca93e483402a7933ff220f1e51fbc93801e35ce938c637a46fe9660fdf6d7e80051d619f8eed427734895cdc5a533983421929f8affc988c0

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://107.175.150.73/~giftioz/.dycosmxiz/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

invoice.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	invoice.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	invoice.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	invoice.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

invoice.exe

description pid process target process

PID 1648 set thread context of 1204 1648 invoice.exe invoice.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

invoice.exe

pid process

1648 invoice.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

invoice.exe

pid process

1648 invoice.exe
1648 invoice.exe

description	pid	process	target process
PID 1648 set thread context of 1204	1648	invoice.exe	invoice.exe

pid	process
1648	invoice.exe

pid	process
1648	invoice.exe
1648	invoice.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

invoice.exe

description	pid	process	target process
PID 1648 wrote to memory of 1204	1648	invoice.exe	invoice.exe
PID 1648 wrote to memory of 1204	1648	invoice.exe	invoice.exe
PID 1648 wrote to memory of 1204	1648	invoice.exe	invoice.exe
PID 1648 wrote to memory of 1204	1648	invoice.exe	invoice.exe

outlook_office_path 1 IoCs

Processes:

invoice.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	invoice.exe

outlook_win_path 1 IoCs

Processes:

invoice.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	invoice.exe

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-55-0x00000000004139DE-mapping.dmp

Download
memory/1204-58-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1204-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-54-0x00000000755B1000-0x00000000755B3000-memory.dmp

Filesize
8KB

Download
memory/1648-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads