lokibot | 4516464ea0f1737577c1bef1720182cacdca6b3598b010cb0a8522bf393b6b0c

General

Target

TRANSFER.exe
Size

512KB
MD5

1086aab81143886e9f560384829f7c6f
SHA1

d9855483093d9a6ed8844c490fb6718437bcbc3f
SHA256

66c8806ba383d1c3671492bff679e2ee9e5f4d384b5a317a44ff45c4410a1e86
SHA512

e11fba1774658df4b824ad83224f8ba347cfcbd2d1108ea2be23c5fc820ce02ff2c9de1d1d919174d85d00dce56c5205be1c4813fe964645cc3641dfe7133ddd
SSDEEP

12288:OHOSiPb+HT0qE8S6S7ztLHKNu+A+/1bkYbupzTY0tKGIfpBGrQk2SP8D:Oub8vOztLHKNu+A+/1b9bupzrd8GrQkY

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha7/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

TRANSFER.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	TRANSFER.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	TRANSFER.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TRANSFER.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TRANSFER.exe

description pid process target process

PID 1464 set thread context of 1156 1464 TRANSFER.exe TRANSFER.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

TRANSFER.exe

pid process

1156 TRANSFER.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TRANSFER.exe

description pid process

Token: SeDebugPrivilege 1156 TRANSFER.exe

description	pid	process	target process
PID 1464 set thread context of 1156	1464	TRANSFER.exe	TRANSFER.exe

pid	process
1156	TRANSFER.exe

description	pid	process
Token: SeDebugPrivilege	1156	TRANSFER.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

TRANSFER.exe

description	pid	process	target process
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe
PID 1464 wrote to memory of 1156	1464	TRANSFER.exe	TRANSFER.exe

outlook_office_path 1 IoCs

Processes:

TRANSFER.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TRANSFER.exe

outlook_win_path 1 IoCs

Processes:

TRANSFER.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	TRANSFER.exe

C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe
"C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Local\Temp\TRANSFER.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-68-0x00000000004139DE-mapping.dmp

Download
memory/1156-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1156-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1464-54-0x0000000000BA0000-0x0000000000C26000-memory.dmp

Filesize
536KB

Download
memory/1464-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1464-58-0x0000000000790000-0x00000000007B0000-memory.dmp

Filesize
128KB

Download
memory/1464-57-0x0000000004DC0000-0x0000000004E32000-memory.dmp

Filesize
456KB

Download
memory/1464-56-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads