lokibot | b2ad328c5f05213dd4f1fd127b2201a498eccfb67bd07bf48eb432c69ec94dfd

General

Target

Flowtronix enquiry.exe
Size

700KB
MD5

6a46df422796f0c3b68f869741c924e9
SHA1

b16126baa282032e1a0e84dafd26536072e19f16
SHA256

5481601d66580551f4f9fa6841076d2ac05189ac292da6a983c5ab44e208e270
SHA512

ce5f464a23fd62c72a3ca2b8c8a12bd6d59b112c5407124506187c49009b1cf4a70a9398cec1d0958fa5aaf4e12a025c21a332b4a6849ce14705967e5b1d1629
SSDEEP

12288:SUbgw6ZNi99YaiT7uJTpz0buZyQOhON9wbVtFdBy0EVQjwcob:QdZYkaiT7ufwhtJtFT

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gk18/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Flowtronix enquiry.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Flowtronix enquiry.exe

description pid process target process

PID 900 set thread context of 1744 900 Flowtronix enquiry.exe Flowtronix enquiry.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Flowtronix enquiry.exe

pid process

1744 Flowtronix enquiry.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Flowtronix enquiry.exe

description pid process

Token: SeDebugPrivilege 1744 Flowtronix enquiry.exe

description	pid	process	target process
PID 900 set thread context of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe

pid	process
1744	Flowtronix enquiry.exe

description	pid	process
Token: SeDebugPrivilege	1744	Flowtronix enquiry.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Flowtronix enquiry.exe

description	pid	process	target process
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 900 wrote to memory of 1744	900	Flowtronix enquiry.exe	Flowtronix enquiry.exe

outlook_office_path 1 IoCs

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe

outlook_win_path 1 IoCs

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Flowtronix enquiry.exe

C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000000240000-0x00000000002F6000-memory.dmp

Filesize
728KB

Download
memory/900-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/900-57-0x00000000007D0000-0x00000000007DC000-memory.dmp

Filesize
48KB

Download
memory/900-58-0x0000000007810000-0x0000000007888000-memory.dmp

Filesize
480KB

Download
memory/900-59-0x0000000002120000-0x0000000002140000-memory.dmp

Filesize
128KB

Download
memory/1744-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-69-0x00000000004139DE-mapping.dmp

Download
memory/1744-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1744-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads