lokibot | 7b65ae5cd1e482e102fa53d2efffb9f91eeb0102f364edaea212c008606df265

General

Target

AccountsReceivableagingRoritViewerAMFG9836pdf.exe
Size

567KB
MD5

8ba81acc67ca2df1a6801e3023ac9a12
SHA1

e7151e1ea288661b85baff7067768d2f3aa75aec
SHA256

7b65ae5cd1e482e102fa53d2efffb9f91eeb0102f364edaea212c008606df265
SHA512

b44b0f9fc155a414cdb2afb95a0a43f5e1006b784773f59b31d9bacc344a443aa05e49ed59393f3a1951a666d710f2016955e02e011f7359e5632c78eeaddc67
SSDEEP

6144:502FDLF3428ehddJCWi3LS9gl7jGu3nVSsNWvhONGZhTZ+qkf9j:5lVLFFBLCWi+9gl/G/s0pj9Z+q+1

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/hb1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe
Token: SeDebugPrivilege	860	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 268	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	27
PID 2036 wrote to memory of 268	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	27
PID 2036 wrote to memory of 268	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	27
PID 2036 wrote to memory of 268	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	27
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29
PID 2036 wrote to memory of 860	2036	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\AccountsReceivableagingRoritViewerAMFG9836pdf.exe
"C:\Users\Admin\AppData\Local\Temp\AccountsReceivableagingRoritViewerAMFG9836pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pXePDzyYogqd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp911A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp911A.tmp

Filesize
1KB

MD5
70ba1cc06ae5da4464c28afccbaf2aa2

SHA1
669a285fa7fba7c5c4c23f1152c365211b68235b

SHA256
190f7df4338165f6df1e94dd00afd90e0f4223d51ce0e40b561aaa22f0fc4d68

SHA512
68abf3d7c11181e818f14c15160158141b01f7e48fa7acde0b39364fa82d47eb26942e8b071184ed559d325f250a0771056930ac6410ab796886e074b4a15ba4

Download Submit
memory/860-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/860-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-77-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/860-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2036-59-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/2036-54-0x0000000001330000-0x00000000013C4000-memory.dmp

Filesize
592KB

Download
memory/2036-56-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2036-55-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/2036-58-0x0000000001100000-0x0000000001172000-memory.dmp

Filesize
456KB

Download
memory/2036-57-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads