lokibot | b2ad328c5f05213dd4f1fd127b2201a498eccfb67bd07bf48eb432c69ec94dfd

Analysis

max time kernel
141s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flowtronix enquiry.exe
Size

700KB
MD5

6a46df422796f0c3b68f869741c924e9
SHA1

b16126baa282032e1a0e84dafd26536072e19f16
SHA256

5481601d66580551f4f9fa6841076d2ac05189ac292da6a983c5ab44e208e270
SHA512

ce5f464a23fd62c72a3ca2b8c8a12bd6d59b112c5407124506187c49009b1cf4a70a9398cec1d0958fa5aaf4e12a025c21a332b4a6849ce14705967e5b1d1629
SSDEEP

12288:SUbgw6ZNi99YaiT7uJTpz0buZyQOhON9wbVtFdBy0EVQjwcob:QdZYkaiT7ufwhtJtFT

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://sempersim.su/gk18/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Flowtronix enquiry.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Flowtronix enquiry.exe

description pid process target process

PID 4688 set thread context of 3332 4688 Flowtronix enquiry.exe Flowtronix enquiry.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Flowtronix enquiry.exe

pid process

3332 Flowtronix enquiry.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Flowtronix enquiry.exe

description pid process

Token: SeDebugPrivilege 3332 Flowtronix enquiry.exe

description	pid	process	target process
PID 4688 set thread context of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe

pid	process
3332	Flowtronix enquiry.exe

description	pid	process
Token: SeDebugPrivilege	3332	Flowtronix enquiry.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Flowtronix enquiry.exe

description	pid	process	target process
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe
PID 4688 wrote to memory of 3332	4688	Flowtronix enquiry.exe	Flowtronix enquiry.exe

outlook_office_path 1 IoCs

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Flowtronix enquiry.exe

outlook_win_path 1 IoCs

Processes:

Flowtronix enquiry.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Flowtronix enquiry.exe

C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Flowtronix enquiry.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3332-138-0x0000000000000000-mapping.dmp

Download
memory/3332-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3332-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3332-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3332-143-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4688-132-0x0000000000270000-0x0000000000326000-memory.dmp

Filesize
728KB

Download
memory/4688-133-0x0000000007780000-0x0000000007D24000-memory.dmp

Filesize
5.6MB

Download
memory/4688-134-0x00000000071D0000-0x0000000007262000-memory.dmp

Filesize
584KB

Download
memory/4688-135-0x0000000004D60000-0x0000000004D6A000-memory.dmp

Filesize
40KB

Download
memory/4688-136-0x00000000097E0000-0x000000000987C000-memory.dmp

Filesize
624KB

Download
memory/4688-137-0x0000000000D50000-0x0000000000DB6000-memory.dmp

Filesize
408KB

Download