lokibot | 132b2bec8d938eeff8eaa559349a7a2a272a957fef0e4f3e9bcb4241eadf7e68

General

Target

b5ba4eaf57db9c19bc0e704b3d313972.exe
Size

1.0MB
MD5

b5ba4eaf57db9c19bc0e704b3d313972
SHA1

063e22cdf48221f7a040fe38b8ac3c3d2caa1a95
SHA256

132b2bec8d938eeff8eaa559349a7a2a272a957fef0e4f3e9bcb4241eadf7e68
SHA512

37c7ae157883c2f74b3d9f510a86ea1562a46b3e5ab050a7078ec5bb6efc0a64649361ebe38fbe467bdd189fcfaf9e4b1731694620585a873e30938460a27734
SSDEEP

12288:9fO58lLnM6azXzZ2EBe6ZkdkchAi1jofnCR/dr5H19HUINQEjR9RAhE804rfG0Dv:y8C6qXNtBe6sF1jofCRlr11SARRcE0

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://162.0.223.13/?OpqycIYJoIxPvNI7mSRvpEdWbvlzd7L2wbAJUztih08MOR

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b5ba4eaf57db9c19bc0e704b3d313972.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b5ba4eaf57db9c19bc0e704b3d313972.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b5ba4eaf57db9c19bc0e704b3d313972.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

description pid process target process

PID 2036 set thread context of 1876 2036 b5ba4eaf57db9c19bc0e704b3d313972.exe b5ba4eaf57db9c19bc0e704b3d313972.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

pid process

2036 b5ba4eaf57db9c19bc0e704b3d313972.exe
2036 b5ba4eaf57db9c19bc0e704b3d313972.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

pid process

1876 b5ba4eaf57db9c19bc0e704b3d313972.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exeb5ba4eaf57db9c19bc0e704b3d313972.exe

description pid process

Token: SeDebugPrivilege 2036 b5ba4eaf57db9c19bc0e704b3d313972.exe
Token: SeDebugPrivilege 1876 b5ba4eaf57db9c19bc0e704b3d313972.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

pid process

2036 b5ba4eaf57db9c19bc0e704b3d313972.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

pid process

2036 b5ba4eaf57db9c19bc0e704b3d313972.exe

description	pid	process	target process
PID 2036 set thread context of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe

pid	process
2036	b5ba4eaf57db9c19bc0e704b3d313972.exe
2036	b5ba4eaf57db9c19bc0e704b3d313972.exe

pid	process
1876	b5ba4eaf57db9c19bc0e704b3d313972.exe

description	pid	process
Token: SeDebugPrivilege	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe
Token: SeDebugPrivilege	1876	b5ba4eaf57db9c19bc0e704b3d313972.exe

pid	process
2036	b5ba4eaf57db9c19bc0e704b3d313972.exe

pid	process
2036	b5ba4eaf57db9c19bc0e704b3d313972.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

outlook_office_path 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	b5ba4eaf57db9c19bc0e704b3d313972.exe

outlook_win_path 1 IoCs

Processes:

b5ba4eaf57db9c19bc0e704b3d313972.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b5ba4eaf57db9c19bc0e704b3d313972.exe

C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe
"C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe
"C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe"
2⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe
"C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe"
2⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe
"C:\Users\Admin\AppData\Local\Temp\b5ba4eaf57db9c19bc0e704b3d313972.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-70-0x00000000004139DE-mapping.dmp

Download
memory/1876-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-76-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-77-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1876-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2036-56-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download
memory/2036-54-0x00000000009D0000-0x0000000000AE0000-memory.dmp

Filesize
1.1MB

Download
memory/2036-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/2036-60-0x00000000049B0000-0x0000000004A14000-memory.dmp

Filesize
400KB

Download
memory/2036-73-0x0000000004ED5000-0x0000000004EE6000-memory.dmp

Filesize
68KB

Download
memory/2036-59-0x0000000005F90000-0x000000000604A000-memory.dmp

Filesize
744KB

Download
memory/2036-58-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/2036-57-0x0000000004ED5000-0x0000000004EE6000-memory.dmp

Filesize
68KB

Download

description	pid	process	target process
PID 2036 wrote to memory of 1748	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1748	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1748	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1748	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1736	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1736	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1736	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1736	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe
PID 2036 wrote to memory of 1876	2036	b5ba4eaf57db9c19bc0e704b3d313972.exe	b5ba4eaf57db9c19bc0e704b3d313972.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads