lokibot | b0e9ab8722211e906494335f94c75e0b7ab1bbd53b2b036e0b316daa11c0e7fd

General

Target

c21f8d352d2afd341355721a5f12f288.exe
Size

1.3MB
MD5

c21f8d352d2afd341355721a5f12f288
SHA1

39bcc6535cb57b87f1a6074408b1823b8cb5e698
SHA256

b0e9ab8722211e906494335f94c75e0b7ab1bbd53b2b036e0b316daa11c0e7fd
SHA512

e9afd875c1c7a2c58f082d9b05edbfdd32e703e4122ab5802a28c2b9426720e9dfaebedcaafe10e492f89b457a84ba602d9396cd9a130698dbab46c9aa83f263
SSDEEP

24576:eCtDtoThLb5+pUBYf1hHsg20qKTCDiFg9JlN6UICNpJ+4zcCDdqkTzhjuBz2Wc:B8jqQKTCuilYEzcCDdqkTzhjuBz

Score

10^/10

lokibot collection persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://104.156.227.195/~blog/?p=4734961764423

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mrtngbobqu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ihekbfxvie\\Mrtngbobqu.exe\""	c21f8d352d2afd341355721a5f12f288.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	836	c21f8d352d2afd341355721a5f12f288.exe
Token: SeDebugPrivilege	1960	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 840	836	c21f8d352d2afd341355721a5f12f288.exe	28
PID 836 wrote to memory of 840	836	c21f8d352d2afd341355721a5f12f288.exe	28
PID 836 wrote to memory of 840	836	c21f8d352d2afd341355721a5f12f288.exe	28
PID 836 wrote to memory of 840	836	c21f8d352d2afd341355721a5f12f288.exe	28
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30
PID 836 wrote to memory of 1960	836	c21f8d352d2afd341355721a5f12f288.exe	30

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\c21f8d352d2afd341355721a5f12f288.exe
"C:\Users\Admin\AppData\Local\Temp\c21f8d352d2afd341355721a5f12f288.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x00000000008B0000-0x00000000009F6000-memory.dmp

Filesize
1.3MB

Download
memory/836-55-0x0000000004970000-0x0000000004A62000-memory.dmp

Filesize
968KB

Download
memory/836-56-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download
memory/836-57-0x0000000002120000-0x00000000021B2000-memory.dmp

Filesize
584KB

Download
memory/836-58-0x00000000021C0000-0x0000000002200000-memory.dmp

Filesize
256KB

Download
memory/836-63-0x00000000021C0000-0x0000000002200000-memory.dmp

Filesize
256KB

Download
memory/840-61-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/840-62-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/1960-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1960-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1960-80-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing