lokibot | 320cd864f1bcd59e122d933cb6cb19cdb1b679bb4e04d48ae81be09803c1cf29

General

Target

1ffe7beaec86f3e15436d8ee1247840e.exe
Size

499KB
MD5

1ffe7beaec86f3e15436d8ee1247840e
SHA1

3981847b1b9e6a73754e55e2814c434f37adeed9
SHA256

320cd864f1bcd59e122d933cb6cb19cdb1b679bb4e04d48ae81be09803c1cf29
SHA512

049dceedf52d61fc9052e02d079db707d9c0e1c337ce425998e40abdd151a5a84535579abf1fa5837d756ffefac8469ac47a40a9a30f00e4097cb3888ae3989f
SSDEEP

12288:VWO+JpbKbf6uMR+mioFhHXhmb84vVEaHgUFC:VWbbKpm73cosV18

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/osburn/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	1ffe7beaec86f3e15436d8ee1247840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	1ffe7beaec86f3e15436d8ee1247840e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	1ffe7beaec86f3e15436d8ee1247840e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	1ffe7beaec86f3e15436d8ee1247840e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	1ffe7beaec86f3e15436d8ee1247840e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	1ffe7beaec86f3e15436d8ee1247840e.exe
Token: SeDebugPrivilege	1648	1ffe7beaec86f3e15436d8ee1247840e.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1608	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	28
PID 1752 wrote to memory of 1608	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	28
PID 1752 wrote to memory of 1608	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	28
PID 1752 wrote to memory of 1608	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	28
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29
PID 1752 wrote to memory of 1648	1752	1ffe7beaec86f3e15436d8ee1247840e.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	1ffe7beaec86f3e15436d8ee1247840e.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	1ffe7beaec86f3e15436d8ee1247840e.exe

C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe
"C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe
  "C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe"
  2⤵
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe
  "C:\Users\Admin\AppData\Local\Temp\1ffe7beaec86f3e15436d8ee1247840e.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1648-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1752-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1752-59-0x0000000000810000-0x0000000000830000-memory.dmp

Filesize
128KB

Download
memory/1752-54-0x0000000001290000-0x0000000001312000-memory.dmp

Filesize
520KB

Download
memory/1752-58-0x0000000005530000-0x000000000558A000-memory.dmp

Filesize
360KB

Download
memory/1752-57-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/1752-56-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing