lokibot | 837a755371d9da370735e9ae34e6405d328e7c1bcdfcb4ed0744aa03a2bbe447

General

Target

ca2900926df66ed59aaacbd5a3394b39.exe
Size

625KB
MD5

ca2900926df66ed59aaacbd5a3394b39
SHA1

966543e1babb946d8581f80c1613ff38ba8a9081
SHA256

837a755371d9da370735e9ae34e6405d328e7c1bcdfcb4ed0744aa03a2bbe447
SHA512

77966f9c56c48f4937d27abb050452bbbf9d0d03ef6643a98a8bfb3d2e7a20d9490ac254f37aedb8e3b68f7b8f3aae88c3dc2446eb27ddbe534b6e5ff728666c
SSDEEP

12288:p+lsOL/GXh8L74mBfNUstzoQDgAAmWWiGqLlmUFjb/n6pUy3rUNVJNT:wM+L74mBfNUstzoMPvEcUjb633r8JN

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl16/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ca2900926df66ed59aaacbd5a3394b39.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ca2900926df66ed59aaacbd5a3394b39.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ca2900926df66ed59aaacbd5a3394b39.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description pid process target process

PID 2040 set thread context of 780 2040 ca2900926df66ed59aaacbd5a3394b39.exe ca2900926df66ed59aaacbd5a3394b39.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

pid process

780 ca2900926df66ed59aaacbd5a3394b39.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description pid process

Token: SeDebugPrivilege 780 ca2900926df66ed59aaacbd5a3394b39.exe

description	pid	process	target process
PID 2040 set thread context of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe

pid	process
780	ca2900926df66ed59aaacbd5a3394b39.exe

description	pid	process
Token: SeDebugPrivilege	780	ca2900926df66ed59aaacbd5a3394b39.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description	pid	process	target process
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe
PID 2040 wrote to memory of 780	2040	ca2900926df66ed59aaacbd5a3394b39.exe	ca2900926df66ed59aaacbd5a3394b39.exe

outlook_office_path 1 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ca2900926df66ed59aaacbd5a3394b39.exe

outlook_win_path 1 IoCs

Processes:

ca2900926df66ed59aaacbd5a3394b39.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ca2900926df66ed59aaacbd5a3394b39.exe

C:\Users\Admin\AppData\Local\Temp\ca2900926df66ed59aaacbd5a3394b39.exe
"C:\Users\Admin\AppData\Local\Temp\ca2900926df66ed59aaacbd5a3394b39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\ca2900926df66ed59aaacbd5a3394b39.exe
"C:\Users\Admin\AppData\Local\Temp\ca2900926df66ed59aaacbd5a3394b39.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-69-0x00000000004139DE-mapping.dmp

Download
memory/780-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/780-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2040-58-0x0000000004A90000-0x0000000004AEA000-memory.dmp

Filesize
360KB

Download
memory/2040-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x0000000000A30000-0x0000000000AD2000-memory.dmp

Filesize
648KB

Download
memory/2040-59-0x0000000000920000-0x0000000000940000-memory.dmp

Filesize
128KB

Download
memory/2040-57-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2040-56-0x0000000000550000-0x0000000000568000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads