lokibot | ad87f3ad6fb14d2b79d7b7aac1b38bc04fd20757460da0f02cac139408df9969

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe
Size 10KB
Sample221024-ja8mhsfdbp
SHA256 ad87f3ad6fb14d2b79d7b7aac1b38bc04fd20757460da0f02cac139408df9969
MD5 736755e65dacf6df87239d0a8ec64b32
SHA1 6e9ab072f81fda3382a4e6a56a3835e2f54bea3f
SHA512 9203456574b7b848b3554b378aea9b5ba008af1932a698c7be8f770537f93054680c1a4002ba48167789caf513272c61c531851eff09785ec1d1337a563b52d4
SSDEEP 96:58k28a86JbEaFLA6+ADxFS/YWehcK/Rq5EwExopj1YdaKNX6Ny3mxzNt:58krdCblFLA6FS/YWeh3Rz0Xnyc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot remcos remotehost collection persistence rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

obologs.work.gd:4044

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F9UER6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

lokibot

http://192.64.118.167/profile.php?id=6iMMKJHCU15sObupIn6Ll6LlnrEG0OS67FTRoBujDALrMfRvD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3336-151-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1228-153-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1228-158-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/memory/3336-151-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/2572-152-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1228-153-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1228-158-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2220	dwn.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dwn.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ndjjtqsvd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dqavw\\Ndjjtqsvd.exe\""	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 5052 set thread context of 1228	5052	aspnet_compiler.exe	94
PID 5052 set thread context of 3336	5052	aspnet_compiler.exe	95
PID 5052 set thread context of 2572	5052	aspnet_compiler.exe	96
PID 2220 set thread context of 4408	2220	dwn.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3932	powershell.exe
3932	powershell.exe
2572	aspnet_compiler.exe
2572	aspnet_compiler.exe
1228	aspnet_compiler.exe
1228	aspnet_compiler.exe
1228	aspnet_compiler.exe
1228	aspnet_compiler.exe
2384	powershell.exe
2384	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5052	aspnet_compiler.exe
5052	aspnet_compiler.exe
5052	aspnet_compiler.exe
5052	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	2572	aspnet_compiler.exe
Token: SeDebugPrivilege	2220	dwn.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	4408	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3932	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	83
PID 1176 wrote to memory of 3932	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	83
PID 1176 wrote to memory of 3932	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	83
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 1176 wrote to memory of 5052	1176	SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe	91
PID 5052 wrote to memory of 5096	5052	aspnet_compiler.exe	93
PID 5052 wrote to memory of 5096	5052	aspnet_compiler.exe	93
PID 5052 wrote to memory of 5096	5052	aspnet_compiler.exe	93
PID 5052 wrote to memory of 1228	5052	aspnet_compiler.exe	94
PID 5052 wrote to memory of 1228	5052	aspnet_compiler.exe	94
PID 5052 wrote to memory of 1228	5052	aspnet_compiler.exe	94
PID 5052 wrote to memory of 1228	5052	aspnet_compiler.exe	94
PID 5052 wrote to memory of 3336	5052	aspnet_compiler.exe	95
PID 5052 wrote to memory of 3336	5052	aspnet_compiler.exe	95
PID 5052 wrote to memory of 3336	5052	aspnet_compiler.exe	95
PID 5052 wrote to memory of 3336	5052	aspnet_compiler.exe	95
PID 5052 wrote to memory of 2572	5052	aspnet_compiler.exe	96
PID 5052 wrote to memory of 2572	5052	aspnet_compiler.exe	96
PID 5052 wrote to memory of 2572	5052	aspnet_compiler.exe	96
PID 5052 wrote to memory of 2572	5052	aspnet_compiler.exe	96
PID 5052 wrote to memory of 2220	5052	aspnet_compiler.exe	97
PID 5052 wrote to memory of 2220	5052	aspnet_compiler.exe	97
PID 5052 wrote to memory of 2220	5052	aspnet_compiler.exe	97
PID 2220 wrote to memory of 2384	2220	dwn.exe	98
PID 2220 wrote to memory of 2384	2220	dwn.exe	98
PID 2220 wrote to memory of 2384	2220	dwn.exe	98
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100
PID 2220 wrote to memory of 4408	2220	dwn.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BackdoorX-gen.12634.2971.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\qoykcontfklbvdkdsywynmfnxmkwqhmqf"
    3⤵
    PID:5096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\qoykcontfklbvdkdsywynmfnxmkwqhmqf"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bidcc"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:3336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\dlrndzjoh"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\dwn.exe
    "C:\Users\Admin\AppData\Local\Temp\dwn.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:4408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 b7255e7ee35727982f66a3263370e14db4ca519d7aae64b97436f9efe72a3056
MD5 c8770cb33a89f3cbaf94e929d7363b16
SHA1 756bc8acf83c6a6da2be3c6b4642029d173e8c93
SHA512 eb4a9a5cd45db9be16536bac89ebe875f842c7d0e6e59761ba378dd13407bfac0a3d7d3f7c11832ec2195e825aab7398b8e31f95e7963f5108dd4464e84f7d5b
SSDEEP 384:Bj+jfa9i+k1O1nvru1Jkko9o2T9K6seYZIJ/r03SoZjsfYSPYjE0LiQ:1Kg1DhJo2T9Ny+YSWGRGE0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwn.exe

Path C:\Users\Admin\AppData\Local\Temp\dwn.exe
Size 6KB
SHA256 2d7e67bffba35a8c1847cec933be9ba5ab20c81d0386699d67ac830966656e93
MD5 d7019ac869240f63fe3b904cf323b98a
SHA1 5dcfeb7e01aa84ed376c5041793c5f673114e741
SHA512 f9e04d338e200e81ecb98fef195043f7ee6fa759da2f906e76aa8f21e9ad7576cd8a6a5db713411a377ae3982cab7ed3082029f419ef58100623679c62ffab1a
SSDEEP 96:1ldkpDCHNmFYuJEWSqzKxCvsQYkj/7H1YdaKNz6NylE4bFnU:PdkhCtmF/JRLKQvsQYQ/7DDUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwn.exe

Path C:\Users\Admin\AppData\Local\Temp\dwn.exe
Size 6KB
SHA256 2d7e67bffba35a8c1847cec933be9ba5ab20c81d0386699d67ac830966656e93
MD5 d7019ac869240f63fe3b904cf323b98a
SHA1 5dcfeb7e01aa84ed376c5041793c5f673114e741
SHA512 f9e04d338e200e81ecb98fef195043f7ee6fa759da2f906e76aa8f21e9ad7576cd8a6a5db713411a377ae3982cab7ed3082029f419ef58100623679c62ffab1a
SSDEEP 96:1ldkpDCHNmFYuJEWSqzKxCvsQYkj/7H1YdaKNz6NylE4bFnU:PdkhCtmF/JRLKQvsQYQ/7DDUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

qoykcontfklbvdkdsywynmfnxmkwqhmqf

Path C:\Users\Admin\AppData\Local\Temp\qoykcontfklbvdkdsywynmfnxmkwqhmqf
Size 4KB
SHA256 bd8156713974af3003c418302d3647fa84f62836fe83613c05e8bc40cb06a867
MD5 952a930b9fe70f809a67cb4e765c9448
SHA1 7e6c235246cc1be14d8a01ee7688a2a2471d44c9
SHA512 10d12f2412fd2cb9ecf47cccd0261b17d9a3323957602c06795c4b2244306837d0a979ec6e552dc023ee81719ebcb9455bdb6f9d44f07788664994d1498452fb
SSDEEP 48:wvvv0DxfvvcDxfdvv0DxBvv0Dxakvv0D7:mvWxvep1vWPvWbvW7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1176-133-0x00000000066B0000-0x00000000066D2000-memory.dmp

Download

memory/1176-132-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

Download

memory/1228-158-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1228-153-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2220-157-0x0000000000180000-0x0000000000188000-memory.dmp

Download

memory/2572-152-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3336-151-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3932-140-0x00000000076E0000-0x0000000007D5A000-memory.dmp

Download

memory/3932-135-0x0000000002A70000-0x0000000002AA6000-memory.dmp

Download

memory/3932-136-0x0000000005210000-0x0000000005838000-memory.dmp

Download

memory/3932-137-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3932-138-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/3932-141-0x0000000006550000-0x000000000656A000-memory.dmp

Download

memory/3932-139-0x0000000006050000-0x000000000606E000-memory.dmp

Download

memory/4408-166-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4408-168-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4408-169-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4408-170-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5052-143-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5052-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5052-146-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5052-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/5052-164-0x0000000000400000-0x000000000047F000-memory.dmp

Download