lokibot | 7b65ae5cd1e482e102fa53d2efffb9f91eeb0102f364edaea212c008606df265

General

Target

AccountsReceivableagingRoritViewerAMFG9836pdf.exe
Size

567KB
MD5

8ba81acc67ca2df1a6801e3023ac9a12
SHA1

e7151e1ea288661b85baff7067768d2f3aa75aec
SHA256

7b65ae5cd1e482e102fa53d2efffb9f91eeb0102f364edaea212c008606df265
SHA512

b44b0f9fc155a414cdb2afb95a0a43f5e1006b784773f59b31d9bacc344a443aa05e49ed59393f3a1951a666d710f2016955e02e011f7359e5632c78eeaddc67
SSDEEP

6144:502FDLF3428ehddJCWi3LS9gl7jGu3nVSsNWvhONGZhTZ+qkf9j:5lVLFFBLCWi+9gl/G/s0pj9Z+q+1

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/hb1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	AccountsReceivableagingRoritViewerAMFG9836pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe
Token: SeDebugPrivilege	4752	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4812	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	92
PID 4040 wrote to memory of 4812	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	92
PID 4040 wrote to memory of 4812	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	92
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94
PID 4040 wrote to memory of 4752	4040	AccountsReceivableagingRoritViewerAMFG9836pdf.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\AccountsReceivableagingRoritViewerAMFG9836pdf.exe
"C:\Users\Admin\AppData\Local\Temp\AccountsReceivableagingRoritViewerAMFG9836pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pXePDzyYogqd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF949.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF949.tmp

Filesize
1KB

MD5
8df792acf336ef23785c8dc2c96d4ead

SHA1
1ee75361eccc6d5a3794b5bfe30363330089a754

SHA256
2275025c4bdd41ca581b48236566102f39174d5d2ff69193f6bfd6cabfef13a0

SHA512
68d3d3fab5c4b3878ef72ac8f6e7d40e26cd34cb0b8a35af5fb9e7de10f389faf5683c4530a547f5fbb7c90b80a7b8b6e258c05a487d900548ccb339f2358b24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/4040-139-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/4040-137-0x0000000005170000-0x000000000517A000-memory.dmp

Filesize
40KB

Download
memory/4040-138-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/4040-133-0x0000000000750000-0x00000000007E4000-memory.dmp

Filesize
592KB

Download
memory/4040-136-0x0000000005280000-0x000000000531C000-memory.dmp

Filesize
624KB

Download
memory/4040-135-0x0000000005190000-0x0000000005222000-memory.dmp

Filesize
584KB

Download
memory/4040-134-0x0000000005830000-0x0000000005DD4000-memory.dmp

Filesize
5.6MB

Download
memory/4752-143-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4752-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4752-147-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4752-168-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4752-176-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads