Overview

overview

10

Static

static

Request fo...s.xlsx

windows7-x64

10

Request fo...s.xlsx

windows10-2004-x64

1

Resubmissions

14-10-2022 11:17

221014-nd22cschb4 8

04-10-2022 07:56

221004-jsn1tsacc4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request for Quotations.xlsx

  • Size

    224KB

  • Sample

    221004-jsn1tsacc4

  • MD5

    1ecd5677bdbe462913c9f86083691a68

  • SHA1

    e415a9e760777635000b0fff2fccdc606f3eea1d

  • SHA256

    4eb2e88f3fff8c16d572b663f0a308d1d988860279b4f4120e67b7c2e5c3ebb4

  • SHA512

    333636fc4eaa9721079b0579de4c920ad44fe02df9468d397d5bc8064e0249388f29efa4369f405947c817e929a5a179cc709ee785facd64b1a164ffd344844d

  • SSDEEP

    6144:+ojGA57x8tQFb7mepx2qMPojnE617Mfpx3oH:nd8Wl5jR6AzZKf4

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://162.0.223.13/?OpqycIYJoIxPvNI7mSRvpEdWbvlzd7L2wbAJUztih08MOR

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Request for Quotations.xlsx

    • Size

      224KB

    • MD5

      1ecd5677bdbe462913c9f86083691a68

    • SHA1

      e415a9e760777635000b0fff2fccdc606f3eea1d

    • SHA256

      4eb2e88f3fff8c16d572b663f0a308d1d988860279b4f4120e67b7c2e5c3ebb4

    • SHA512

      333636fc4eaa9721079b0579de4c920ad44fe02df9468d397d5bc8064e0249388f29efa4369f405947c817e929a5a179cc709ee785facd64b1a164ffd344844d

    • SSDEEP

      6144:+ojGA57x8tQFb7mepx2qMPojnE617Mfpx3oH:nd8Wl5jR6AzZKf4

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks