lokibot | 7c2a8c97b19dc75109d84f8b1e3e658ecf94b6296d848e8c8168c49ef3000fb5

General

Target

tmp.exe
Size

551KB
MD5

38aa7278760793557e4dcfcf1c8879d4
SHA1

4a6f8bc85b8123ef21c6804df73c00c90adae868
SHA256

7c2a8c97b19dc75109d84f8b1e3e658ecf94b6296d848e8c8168c49ef3000fb5
SHA512

e0cfd1ee91979b56c89e0c7771d465a1dcd385ec4d1bcf88ca7e8cd8d014de8350ee18cfc0cc363a36546eba40c512e1a6c082f3f0510c55bff7cfac08e975aa
SSDEEP

6144:xYa65GWBSudlNp+b1XtDaP9yMYTikrDNjSWkCPL6AaotaMNMeVMaMA3:xYpo/aP93lkouPLT3cMfeI3

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Executes dropped EXE 2 IoCs

Processes:

xjuicu.exexjuicu.exe

pid process

428 xjuicu.exe
4880 xjuicu.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
428	xjuicu.exe
4880	xjuicu.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

xjuicu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	xjuicu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	xjuicu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	xjuicu.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

xjuicu.exe

description pid process target process

PID 428 set thread context of 4880 428 xjuicu.exe xjuicu.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xjuicu.exe

pid process

428 xjuicu.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

xjuicu.exe

description pid process

Token: SeDebugPrivilege 4880 xjuicu.exe

description	pid	process	target process
PID 428 set thread context of 4880	428	xjuicu.exe	xjuicu.exe

pid	process
428	xjuicu.exe

description	pid	process
Token: SeDebugPrivilege	4880	xjuicu.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

tmp.exexjuicu.exe

description	pid	process	target process
PID 2212 wrote to memory of 428	2212	tmp.exe	xjuicu.exe
PID 2212 wrote to memory of 428	2212	tmp.exe	xjuicu.exe
PID 2212 wrote to memory of 428	2212	tmp.exe	xjuicu.exe
PID 428 wrote to memory of 4880	428	xjuicu.exe	xjuicu.exe
PID 428 wrote to memory of 4880	428	xjuicu.exe	xjuicu.exe
PID 428 wrote to memory of 4880	428	xjuicu.exe	xjuicu.exe
PID 428 wrote to memory of 4880	428	xjuicu.exe	xjuicu.exe

outlook_office_path 1 IoCs

Processes:

xjuicu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	xjuicu.exe

outlook_win_path 1 IoCs

Processes:

xjuicu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	xjuicu.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\xjuicu.exe
"C:\Users\Admin\AppData\Local\Temp\xjuicu.exe" C:\Users\Admin\AppData\Local\Temp\gedcn.uq
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:428

C:\Users\Admin\AppData\Local\Temp\xjuicu.exe
"C:\Users\Admin\AppData\Local\Temp\xjuicu.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dfefkrlnoh.q

Filesize
124KB

MD5
de0258eeaca25d4b0a166f092d972a47

SHA1
f2174a94c86cc84bde61a856aa06c5269ffab0e2

SHA256
d9fceeb5399dba21cae62de6fa20873933d3a7b0b2c499d902a325b4bcc21090

SHA512
81b54298d8b17615e114e7b9905b5517cc945c065401f92f722b587cad643e27171cd49cdde97417609418358cb2ce04896542dc93b6ed1bbf4abf3b54522df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\gedcn.uq

Filesize
5KB

MD5
72388d2806e8abf0ef29fe2ee9e4a7e9

SHA1
fac860ce15c3ce112a59f60b82ae5ef7cc8b8c73

SHA256
2ed380a821989841adc7f8d78ab77eb5633f2ea559472cdaf26fd7afeee209e2

SHA512
ac089c84a31fa4a0178b5b25936007109a17d4c808e2aeb013cac60ca66ba553a97849fa413ce12822f5db1d25ab008bce8972f6ad717d67a9ec18a682d2a32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjuicu.exe

Filesize
46KB

MD5
e06eb606d8e45b958f703f7609907c20

SHA1
1a592f6bc91fa88c1e75039a9c48a6eab38c1480

SHA256
8cdaa8c78832fc5e53ab2cd5eea5f5ac458a7599c4ed67d985dd3876cfdf8777

SHA512
e0e667cedc9bc5bb18fa2cd7ada2e54e23609d514d90c2d327e77b0c97ca3c3c2c1e6a610571e24a06b9eb2b5c561e35240f63cd9d9184eb44f456d21232b98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjuicu.exe

Filesize
46KB

MD5
e06eb606d8e45b958f703f7609907c20

SHA1
1a592f6bc91fa88c1e75039a9c48a6eab38c1480

SHA256
8cdaa8c78832fc5e53ab2cd5eea5f5ac458a7599c4ed67d985dd3876cfdf8777

SHA512
e0e667cedc9bc5bb18fa2cd7ada2e54e23609d514d90c2d327e77b0c97ca3c3c2c1e6a610571e24a06b9eb2b5c561e35240f63cd9d9184eb44f456d21232b98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjuicu.exe

Filesize
46KB

MD5
e06eb606d8e45b958f703f7609907c20

SHA1
1a592f6bc91fa88c1e75039a9c48a6eab38c1480

SHA256
8cdaa8c78832fc5e53ab2cd5eea5f5ac458a7599c4ed67d985dd3876cfdf8777

SHA512
e0e667cedc9bc5bb18fa2cd7ada2e54e23609d514d90c2d327e77b0c97ca3c3c2c1e6a610571e24a06b9eb2b5c561e35240f63cd9d9184eb44f456d21232b98d

Download Submit
memory/428-132-0x0000000000000000-mapping.dmp

Download
memory/4880-137-0x0000000000000000-mapping.dmp

Download
memory/4880-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4880-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads