lokibot | 85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77 | Triage

Analysis

max time kernel
81s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:14

Sharing

Report Analysis Logs

General

Target

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
Size

613KB
MD5

0a5df7794f57bbada65ccdb4025d562c
SHA1

0271540ff15479122cdbe37efe9ddb778416a9b8
SHA256

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77
SHA512

5301dca1620f4c4082551cf0cb475325721b18a391c9a2ef291cde29f7943d8e354ebc1088c2b76f8114272762d6f39d5435b1f08c4cc4023877dabe643d98aa
SSDEEP

12288:7iVgh/PsZ1DX/VDJGl8z4Zq/zi22d5qh4IWuVAeHx:GVgh/PJyUq/z+s4I

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl16/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

Email Collection

Processes:

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

description	pid	process	target process
PID 2484 set thread context of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

description	pid	process	target process
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
PID 2484 wrote to memory of 1272	2484	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

outlook_office_path 1 IoCs

Processes:

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

outlook_win_path 1 IoCs

Processes:

85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe

C:\Users\Admin\AppData\Local\Temp\85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
"C:\Users\Admin\AppData\Local\Temp\85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe
"C:\Users\Admin\AppData\Local\Temp\85381cce386d43501119062a68fa2ea33428c230d622381d9962aafad694cb77.exe"
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-137-0x0000000000000000-mapping.dmp

Download
memory/1272-138-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1272-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1272-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1272-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2484-132-0x0000000000060000-0x0000000000100000-memory.dmp

Filesize
640KB

Download
memory/2484-133-0x0000000005120000-0x00000000056C4000-memory.dmp

Filesize
5.6MB

Download
memory/2484-134-0x0000000004AB0000-0x0000000004B42000-memory.dmp

Filesize
584KB

Download
memory/2484-135-0x0000000004AA0000-0x0000000004AAA000-memory.dmp

Filesize
40KB

Download
memory/2484-136-0x0000000007080000-0x000000000711C000-memory.dmp

Filesize
624KB

Download