Analysis

  • max time kernel
    56s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/04/2023, 18:20

General

  • Target

    Lokibot.exe

  • Size

    300KB

  • MD5

    f52fbb02ac0666cae74fc389b1844e98

  • SHA1

    f7721d590770e2076e64f148a4ba1241404996b8

  • SHA256

    a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

  • SHA512

    78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

  • SSDEEP

    3072:bGSHTJKB/DA8SBV7Nr6JD6u8w/CpLmrCpLmlrudATPTVWZV5wx3nu9B6jFdnp:bGSzYBchvEJD6LpZj+PTa7wx36AjX

Malware Config

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
    "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
      "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4768

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1804-120-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

          Filesize

          328KB

        • memory/1804-121-0x0000000001770000-0x0000000001784000-memory.dmp

          Filesize

          80KB

        • memory/1804-122-0x0000000005BF0000-0x00000000060EE000-memory.dmp

          Filesize

          5.0MB

        • memory/1804-123-0x0000000005750000-0x0000000005760000-memory.dmp

          Filesize

          64KB

        • memory/1804-124-0x0000000003280000-0x0000000003288000-memory.dmp

          Filesize

          32KB

        • memory/1804-125-0x0000000006310000-0x00000000063A2000-memory.dmp

          Filesize

          584KB

        • memory/1804-126-0x00000000062E0000-0x00000000062E8000-memory.dmp

          Filesize

          32KB

        • memory/1804-127-0x0000000006760000-0x00000000067A4000-memory.dmp

          Filesize

          272KB

        • memory/1804-128-0x0000000005750000-0x0000000005760000-memory.dmp

          Filesize

          64KB

        • memory/1804-129-0x0000000005750000-0x0000000005760000-memory.dmp

          Filesize

          64KB

        • memory/1804-130-0x0000000005750000-0x0000000005760000-memory.dmp

          Filesize

          64KB

        • memory/1804-131-0x00000000067B0000-0x00000000067D2000-memory.dmp

          Filesize

          136KB

        • memory/4768-132-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/4768-135-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/4768-136-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB

        • memory/4768-141-0x0000000000400000-0x00000000004A2000-memory.dmp

          Filesize

          648KB