lokibot | 0ffac76af887d1aadbc9b52dab73c169caeee8ce9905289892fae5064f00099a

General

Target

69115ce1a4e407cc8f543db1d60e6022.exe
Size

762KB
MD5

69115ce1a4e407cc8f543db1d60e6022
SHA1

471d4969a24788f2c38e031e8f8e094f964316bc
SHA256

0ffac76af887d1aadbc9b52dab73c169caeee8ce9905289892fae5064f00099a
SHA512

c9c0aa1cfcfa941daba81b50604a0b2665ba3f0fa7581b9ee050a5eaf6f18c1448a50ffe548134bad57293e40a94e09ed8513441ba0fa727f27a6456c3103394
SSDEEP

12288:dp/SzjT4AYH7CpZNfuLypYQpot5zek06qiOx:az3GmpZNfu+OQ+5zv06qiOx

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/jungletwo/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	69115ce1a4e407cc8f543db1d60e6022.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	69115ce1a4e407cc8f543db1d60e6022.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	69115ce1a4e407cc8f543db1d60e6022.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	69115ce1a4e407cc8f543db1d60e6022.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1692	69115ce1a4e407cc8f543db1d60e6022.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	69115ce1a4e407cc8f543db1d60e6022.exe
Token: SeDebugPrivilege	1692	69115ce1a4e407cc8f543db1d60e6022.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1716	1708	69115ce1a4e407cc8f543db1d60e6022.exe	27
PID 1708 wrote to memory of 1716	1708	69115ce1a4e407cc8f543db1d60e6022.exe	27
PID 1708 wrote to memory of 1716	1708	69115ce1a4e407cc8f543db1d60e6022.exe	27
PID 1708 wrote to memory of 1716	1708	69115ce1a4e407cc8f543db1d60e6022.exe	27
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28
PID 1708 wrote to memory of 1692	1708	69115ce1a4e407cc8f543db1d60e6022.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	69115ce1a4e407cc8f543db1d60e6022.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	69115ce1a4e407cc8f543db1d60e6022.exe

C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe
"C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe
  "C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe
  "C:\Users\Admin\AppData\Local\Temp\69115ce1a4e407cc8f543db1d60e6022.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1692-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1708-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1708-59-0x0000000000AF0000-0x0000000000B10000-memory.dmp

Filesize
128KB

Download
memory/1708-54-0x0000000000D80000-0x0000000000E44000-memory.dmp

Filesize
784KB

Download
memory/1708-58-0x0000000005A90000-0x0000000005B0A000-memory.dmp

Filesize
488KB

Download
memory/1708-57-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/1708-56-0x0000000000900000-0x000000000091A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing