lokibot | f482fea1f48a2c590f2b554dd2bf961234ccff52cc60bac18cbaa84457183afc

General

Target

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
Size

722KB
MD5

50b57b84d880c8181a67fec0bbd0c5aa
SHA1

9e9292ee75fd35a098619461430b1492f4aec52b
SHA256

f482fea1f48a2c590f2b554dd2bf961234ccff52cc60bac18cbaa84457183afc
SHA512

e4020ae88c1197c84a9d59e7161deb7a1f594e4ec5c192da9e0765b230a9b936b84e6102fd356d5a5ee94c3e76b318e1cd83a00df96c93f8b6b8de9836cbb119
SSDEEP

12288:2yzaxCiF3/KJYOu2DhpV4DHfPr6s3ELF3sgouVnJV4ilzP:2yzaYi5KJbu2DDVYXJ3E9sL4z4OP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/gk1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	pid	process	target process
PID 840 set thread context of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

pid process

4648 STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description pid process

Token: SeDebugPrivilege 4648 STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

pid	process
4648	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	pid	process
Token: SeDebugPrivilege	4648	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	pid	process	target process
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
PID 840 wrote to memory of 4648	840	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

outlook_office_path 1 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

outlook_win_path 1 IoCs

Processes:

STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe

C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT ZHEJIANG ASIATOP SLIP.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-132-0x0000000000A40000-0x0000000000AFC000-memory.dmp

Filesize
752KB

Download
memory/840-133-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/840-134-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/840-135-0x0000000005480000-0x000000000548A000-memory.dmp

Filesize
40KB

Download
memory/840-136-0x0000000009000000-0x000000000909C000-memory.dmp

Filesize
624KB

Download
memory/4648-137-0x0000000000000000-mapping.dmp

Download
memory/4648-138-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4648-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4648-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4648-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads