lokibot | 15ff16c0806c71acd981ad9f9a8b6bd31b2c4b9300b0dfad04a8e547e0d8226b

General

Target

50ce8315f89cbfbd96448cb379b6edfd.exe
Size

958KB
MD5

50ce8315f89cbfbd96448cb379b6edfd
SHA1

6678c7d1da5e9735f7fa3aeb68d464e7c6f3d2f4
SHA256

15ff16c0806c71acd981ad9f9a8b6bd31b2c4b9300b0dfad04a8e547e0d8226b
SHA512

21bff9d49c723bda714762df4dcb96345efdb70a67af3a39ac13c0505180d3555f2656f314bd09baf6e690865f07c37a4b20b134a04df49d75eb3e20cb2426a7
SSDEEP

24576:s5U6hLdFChLdFGLdFmhkPyZsP4xSBjC9RBd+sPZ8c5lSxX61liDe1o:YTfFCfFuFQPsP4xSw9nd+k5s0me

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	50ce8315f89cbfbd96448cb379b6edfd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	50ce8315f89cbfbd96448cb379b6edfd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	50ce8315f89cbfbd96448cb379b6edfd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

description pid process target process

PID 1996 set thread context of 1764 1996 50ce8315f89cbfbd96448cb379b6edfd.exe 50ce8315f89cbfbd96448cb379b6edfd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

pid process

1996 50ce8315f89cbfbd96448cb379b6edfd.exe
1996 50ce8315f89cbfbd96448cb379b6edfd.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

pid process

1764 50ce8315f89cbfbd96448cb379b6edfd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe50ce8315f89cbfbd96448cb379b6edfd.exe

description pid process

Token: SeDebugPrivilege 1996 50ce8315f89cbfbd96448cb379b6edfd.exe
Token: SeDebugPrivilege 1764 50ce8315f89cbfbd96448cb379b6edfd.exe

description	pid	process	target process
PID 1996 set thread context of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe

pid	process
1996	50ce8315f89cbfbd96448cb379b6edfd.exe
1996	50ce8315f89cbfbd96448cb379b6edfd.exe

pid	process
1764	50ce8315f89cbfbd96448cb379b6edfd.exe

description	pid	process
Token: SeDebugPrivilege	1996	50ce8315f89cbfbd96448cb379b6edfd.exe
Token: SeDebugPrivilege	1764	50ce8315f89cbfbd96448cb379b6edfd.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

outlook_office_path 1 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	50ce8315f89cbfbd96448cb379b6edfd.exe

outlook_win_path 1 IoCs

Processes:

50ce8315f89cbfbd96448cb379b6edfd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	50ce8315f89cbfbd96448cb379b6edfd.exe

C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe
"C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe
"C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe"
2⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe
"C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe"
2⤵
PID:548

C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe
"C:\Users\Admin\AppData\Local\Temp\50ce8315f89cbfbd96448cb379b6edfd.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1764-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1996-59-0x0000000005D50000-0x0000000005DEA000-memory.dmp

Filesize
616KB

Download
memory/1996-58-0x0000000001F30000-0x0000000001F3C000-memory.dmp

Filesize
48KB

Download
memory/1996-54-0x00000000001A0000-0x0000000000296000-memory.dmp

Filesize
984KB

Download
memory/1996-56-0x0000000000640000-0x0000000000660000-memory.dmp

Filesize
128KB

Download
memory/1996-60-0x0000000004190000-0x00000000041B2000-memory.dmp

Filesize
136KB

Download
memory/1996-55-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1996-57-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download

description	pid	process	target process
PID 1996 wrote to memory of 1952	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1952	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1952	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1952	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 548	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 548	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 548	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 548	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe
PID 1996 wrote to memory of 1764	1996	50ce8315f89cbfbd96448cb379b6edfd.exe	50ce8315f89cbfbd96448cb379b6edfd.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads