lokibot | 622b22f54e4d408ed547536ee1ec8714411cefebb170d69aeb6aae8a23a22233

Analysis

max time kernel
95s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ MV-Haian.exe
Size

485KB
MD5

14118ff01802f541e0593c3efc0b55c4
SHA1

70e44e69b10a80f2a987c061febc154c5226f3bf
SHA256

622b22f54e4d408ed547536ee1ec8714411cefebb170d69aeb6aae8a23a22233
SHA512

c0123827bc905c39692286931836fa9d076264d56a1bf3c761ef63e670802b1a050c76e61e44780bf55b98635a82c2f7d696fa42e02137050b801a9e7bc0c076
SSDEEP

12288:qWO+CpbKbfqFEtigKKyBG3qoS2xTSZRncT5S:qWIbKjthKep/NSZRcT

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://sempersim.su/gm9/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RFQ MV-Haian.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RFQ MV-Haian.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ MV-Haian.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 2320	4556	RFQ MV-Haian.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84
PID 4556 wrote to memory of 2320	4556	RFQ MV-Haian.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RFQ MV-Haian.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RFQ MV-Haian.exe

C:\Users\Admin\AppData\Local\Temp\RFQ MV-Haian.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ MV-Haian.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\RFQ MV-Haian.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ MV-Haian.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  - outlook_win_path
  PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-138-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2320-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2320-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2320-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4556-132-0x0000000000CA0000-0x0000000000D1E000-memory.dmp

Filesize
504KB

Download
memory/4556-133-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/4556-134-0x00000000056B0000-0x0000000005742000-memory.dmp

Filesize
584KB

Download
memory/4556-135-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/4556-136-0x0000000008070000-0x000000000810C000-memory.dmp

Filesize
624KB

Download