lokibot | ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead

General

Target

ProductDetails21638.exe
Size

1.4MB
MD5

e8443af1626f6ccdff4e82cfd293f232
SHA1

9b6a9922c4f1475bf9bf1dd2f71f88905e4a8d90
SHA256

ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead
SHA512

0e8d74490b486320fc3ad65e1f10af78a8da7d83170f0b79b8f9b56a74707ea920599467212886acdf09d3e61b805c7e3468ef96ad052b4adbd9706a55b53d62
SSDEEP

12288:xnjoVnNCBllTDonWZQzjFeM6DJOjB9sTTHyaTE78+agEWflDY8xulEV0VrB2dfb1:UNclQnYQb6VOWQ77agEilDrxulEVQkp

Score

10^/10

lokibot wshrat collection persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://45.155.165.70/se8se/pin.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

wshrat

C2

http://rze6.sytes.net:4000

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
4	1104	wscript.exe
6	1104	wscript.exe
7	1104	wscript.exe
12	1104	wscript.exe
13	1104	wscript.exe
14	1104	wscript.exe
16	1104	wscript.exe
17	1104	wscript.exe
18	1104	wscript.exe
20	1104	wscript.exe
21	1104	wscript.exe
22	1104	wscript.exe
24	1104	wscript.exe
25	1104	wscript.exe
27	1104	wscript.exe
29	1104	wscript.exe

Drops startup file 2 IoCs

Processes:

WScript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ytdkdurodzdbuild.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ytdkdurodzdbuild.js	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ProductDetails21638.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ProductDetails21638.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ProductDetails21638.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ProductDetails21638.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeProductDetails21638.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Ytdkdurodzdbuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Ytdkdurodzdbuild.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Utmlnipujo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tovisqmi\\Utmlnipujo.exe\""	ProductDetails21638.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	WScript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ytdkdurodzdbuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Ytdkdurodzdbuild.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ytdkdurodzdbuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Ytdkdurodzdbuild.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Ytdkdurodzdbuild = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Ytdkdurodzdbuild.js\""	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ProductDetails21638.exe

description pid process target process

PID 1200 set thread context of 884 1200 ProductDetails21638.exe ProductDetails21638.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1200 set thread context of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe

Script User-Agent 16 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	7	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	22	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	27	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	12	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	16	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	29	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	4	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	20	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	21	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	24	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	25	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	6	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	13	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	14	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	17	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript
HTTP User-Agent header	18	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/10/2022\|JavaScript

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2040 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ProductDetails21638.exe

pid process

884 ProductDetails21638.exe

pid	process
2040	powershell.exe

pid	process
884	ProductDetails21638.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeProductDetails21638.exeProductDetails21638.exe

description	pid	process
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1200	ProductDetails21638.exe
Token: SeDebugPrivilege	884	ProductDetails21638.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

ProductDetails21638.exeWScript.exe

description	pid	process	target process
PID 1200 wrote to memory of 2040	1200	ProductDetails21638.exe	powershell.exe
PID 1200 wrote to memory of 2040	1200	ProductDetails21638.exe	powershell.exe
PID 1200 wrote to memory of 2040	1200	ProductDetails21638.exe	powershell.exe
PID 1200 wrote to memory of 2040	1200	ProductDetails21638.exe	powershell.exe
PID 1200 wrote to memory of 1784	1200	ProductDetails21638.exe	WScript.exe
PID 1200 wrote to memory of 1784	1200	ProductDetails21638.exe	WScript.exe
PID 1200 wrote to memory of 1784	1200	ProductDetails21638.exe	WScript.exe
PID 1200 wrote to memory of 1784	1200	ProductDetails21638.exe	WScript.exe
PID 1784 wrote to memory of 1104	1784	WScript.exe	wscript.exe
PID 1784 wrote to memory of 1104	1784	WScript.exe	wscript.exe
PID 1784 wrote to memory of 1104	1784	WScript.exe	wscript.exe
PID 1784 wrote to memory of 1104	1784	WScript.exe	wscript.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe
PID 1200 wrote to memory of 884	1200	ProductDetails21638.exe	ProductDetails21638.exe

outlook_office_path 1 IoCs

Processes:

ProductDetails21638.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ProductDetails21638.exe

outlook_win_path 1 IoCs

Processes:

ProductDetails21638.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ProductDetails21638.exe

C:\Users\Admin\AppData\Local\Temp\ProductDetails21638.exe
"C:\Users\Admin\AppData\Local\Temp\ProductDetails21638.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ytdkdurodzdbuild.js"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Ytdkdurodzdbuild.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1104

C:\Users\Admin\AppData\Local\Temp\ProductDetails21638.exe
C:\Users\Admin\AppData\Local\Temp\ProductDetails21638.exe
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ytdkdurodzdbuild.js
Filesize
21KB

MD5
cbae567eae4873a19dc1d77885e3ea0f

SHA1
669b5cce2f71651aac783b714140e20552c244fe

SHA256
30e25144d8c3639fad6741c664ce2444076a53176acd50c0760c71c800c05d79

SHA512
85a25484308c03b70418a86878c67a0b0689b1c5f55a78e4c835d5ccb3b256b4b53344d97f6779320d6d0ee50077afb9938e95a32b5058a3c4df100db481c4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ytdkdurodzdbuild.js
Filesize
21KB

MD5
cbae567eae4873a19dc1d77885e3ea0f

SHA1
669b5cce2f71651aac783b714140e20552c244fe

SHA256
30e25144d8c3639fad6741c664ce2444076a53176acd50c0760c71c800c05d79

SHA512
85a25484308c03b70418a86878c67a0b0689b1c5f55a78e4c835d5ccb3b256b4b53344d97f6779320d6d0ee50077afb9938e95a32b5058a3c4df100db481c4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Ytdkdurodzdbuild.js
Filesize
21KB

MD5
cbae567eae4873a19dc1d77885e3ea0f

SHA1
669b5cce2f71651aac783b714140e20552c244fe

SHA256
30e25144d8c3639fad6741c664ce2444076a53176acd50c0760c71c800c05d79

SHA512
85a25484308c03b70418a86878c67a0b0689b1c5f55a78e4c835d5ccb3b256b4b53344d97f6779320d6d0ee50077afb9938e95a32b5058a3c4df100db481c4c9

Download Submit
memory/884-80-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-78-0x00000000004139DE-mapping.dmp

Download
memory/884-77-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-82-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/884-83-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1104-65-0x0000000000000000-mapping.dmp

Download
memory/1200-54-0x00000000009A0000-0x0000000000B04000-memory.dmp

Filesize
1.4MB

Download
memory/1200-56-0x00000000049D0000-0x0000000004A62000-memory.dmp

Filesize
584KB

Download
memory/1200-55-0x0000000004420000-0x00000000044D2000-memory.dmp

Filesize
712KB

Download
memory/1784-62-0x0000000000000000-mapping.dmp

Download
memory/2040-61-0x000000006FE50000-0x00000000703FB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-60-0x000000006FE50000-0x00000000703FB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-59-0x000000006FE50000-0x00000000703FB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-58-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads