lokibot | 30a20d82d44b2c3ab9122cf88f156134484b9ed949cf99154b26fb8861b87a04

General

Target

DHL AWB SHIPMENTS DOCS.exe
Size

44KB
MD5

620d7b7b9c75c1bd5a921927cc833248
SHA1

20822406537e8fbd03ec11faec991952c8cd134d
SHA256

c707ec1a12a940e07233173f3df3203e32dfcbc5771c455300cd84935b4062c9
SHA512

95f6747c0100f1dcc6481dc90cf2682412bcf9b40cc56b886f3f5b186875ed2acebffe6794c81967212173ff1f4cb3a97da0f3a42814d406770db679c5a0579a
SSDEEP

384:k9JBtLK/tFBfGh0rGjb2RbnxUSlXAo5Ga+m3oV:0jEKibUOXv5yh

Score

10^/10

lokibot collection persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://162.0.223.13/?rujsZEinqQuPZBS8kKnSq21shtrtBBS26bv5QNtgEY6EzZMUJaM9cOCuh3YSFQVL2qQSek9TifxRfkMYuy8HmK

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DHL AWB SHIPMENTS DOCS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	DHL AWB SHIPMENTS DOCS.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	DHL AWB SHIPMENTS DOCS.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	DHL AWB SHIPMENTS DOCS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Orljzrrt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xlgxdamltlb\\Orljzrrt.exe\""	DHL AWB SHIPMENTS DOCS.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

description pid process target process

PID 4796 set thread context of 4200 4796 DHL AWB SHIPMENTS DOCS.exe DHL AWB SHIPMENTS DOCS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1328 powershell.exe
1328 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

pid process

4200 DHL AWB SHIPMENTS DOCS.exe

description	pid	process	target process
PID 4796 set thread context of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe

pid	process
1328	powershell.exe
1328	powershell.exe

pid	process
4200	DHL AWB SHIPMENTS DOCS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exepowershell.exeDHL AWB SHIPMENTS DOCS.exe

description	pid	process
Token: SeDebugPrivilege	4796	DHL AWB SHIPMENTS DOCS.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	4200	DHL AWB SHIPMENTS DOCS.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	pid	process	target process
PID 4796 wrote to memory of 1328	4796	DHL AWB SHIPMENTS DOCS.exe	powershell.exe
PID 4796 wrote to memory of 1328	4796	DHL AWB SHIPMENTS DOCS.exe	powershell.exe
PID 4796 wrote to memory of 1328	4796	DHL AWB SHIPMENTS DOCS.exe	powershell.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe
PID 4796 wrote to memory of 4200	4796	DHL AWB SHIPMENTS DOCS.exe	DHL AWB SHIPMENTS DOCS.exe

outlook_office_path 1 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	DHL AWB SHIPMENTS DOCS.exe

outlook_win_path 1 IoCs

Processes:

DHL AWB SHIPMENTS DOCS.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	DHL AWB SHIPMENTS DOCS.exe

C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB SHIPMENTS DOCS.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-138-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/1328-140-0x00000000077F0000-0x0000000007E6A000-memory.dmp

Filesize
6.5MB

Download
memory/1328-134-0x0000000000000000-mapping.dmp

Download
memory/1328-135-0x00000000029C0000-0x00000000029F6000-memory.dmp

Filesize
216KB

Download
memory/1328-136-0x0000000005150000-0x0000000005778000-memory.dmp

Filesize
6.2MB

Download
memory/1328-137-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/1328-141-0x0000000006470000-0x000000000648A000-memory.dmp

Filesize
104KB

Download
memory/1328-139-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/4200-142-0x0000000000000000-mapping.dmp

Download
memory/4200-143-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4200-145-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4200-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4200-147-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4796-132-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/4796-133-0x00000000068E0000-0x0000000006902000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads