lokibot | 475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Corresponding Details.exe
Size 927KB
Sample240214-snfy4aeb2s
SHA256 475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512
MD5 9d75b956b1aaaa9f0bbb13cb760f7494
SHA1 612f4c7d0d30d1c9250a5bfaaade25f950f5012e
SHA512 46d59a1daeabc0942ab1365d772e95d28a09e6d71fd42e76daf5073f125e633b0764a5ec328c6591e2ded4d8bdcc2c806fc3fb3707d34b33f7cb25e7f0fc20ff
SSDEEP 12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a1yUz4qVqcVWYh/e+Wf:oRmJkcoQricOIQxiZY1ia17cqV1teZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://ebnsina.top/kelvin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 3848	4884	Corresponding Details.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4112	Corresponding Details.exe
2280	Corresponding Details.exe
4588	Corresponding Details.exe
1232	Corresponding Details.exe
4884	Corresponding Details.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4580	4112	Corresponding Details.exe	86
PID 4112 wrote to memory of 4580	4112	Corresponding Details.exe	86
PID 4112 wrote to memory of 4580	4112	Corresponding Details.exe	86
PID 4112 wrote to memory of 2280	4112	Corresponding Details.exe	85
PID 4112 wrote to memory of 2280	4112	Corresponding Details.exe	85
PID 4112 wrote to memory of 2280	4112	Corresponding Details.exe	85
PID 2280 wrote to memory of 4228	2280	Corresponding Details.exe	87
PID 2280 wrote to memory of 4228	2280	Corresponding Details.exe	87
PID 2280 wrote to memory of 4228	2280	Corresponding Details.exe	87
PID 2280 wrote to memory of 4588	2280	Corresponding Details.exe	88
PID 2280 wrote to memory of 4588	2280	Corresponding Details.exe	88
PID 2280 wrote to memory of 4588	2280	Corresponding Details.exe	88
PID 4588 wrote to memory of 3592	4588	Corresponding Details.exe	89
PID 4588 wrote to memory of 3592	4588	Corresponding Details.exe	89
PID 4588 wrote to memory of 3592	4588	Corresponding Details.exe	89
PID 4588 wrote to memory of 1232	4588	Corresponding Details.exe	90
PID 4588 wrote to memory of 1232	4588	Corresponding Details.exe	90
PID 4588 wrote to memory of 1232	4588	Corresponding Details.exe	90
PID 1232 wrote to memory of 2336	1232	Corresponding Details.exe	91
PID 1232 wrote to memory of 2336	1232	Corresponding Details.exe	91
PID 1232 wrote to memory of 2336	1232	Corresponding Details.exe	91
PID 1232 wrote to memory of 4884	1232	Corresponding Details.exe	92
PID 1232 wrote to memory of 4884	1232	Corresponding Details.exe	92
PID 1232 wrote to memory of 4884	1232	Corresponding Details.exe	92
PID 4884 wrote to memory of 3848	4884	Corresponding Details.exe	97
PID 4884 wrote to memory of 3848	4884	Corresponding Details.exe	97
PID 4884 wrote to memory of 3848	4884	Corresponding Details.exe	97
PID 4884 wrote to memory of 3848	4884	Corresponding Details.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe
"C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe
  "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
    3⤵
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe
      "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
      4⤵
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:3848
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Corresponding Details.exe"
  2⤵
  PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut568C.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut568C.tmp
Size 83KB
SHA256 91c60a199e667385f86b0397d961240b3ce88a2bdf5813c7a489840f05b74df0
MD5 121d6eb94ff85a8d03548bd1e021e718
SHA1 c4712994df57170997d5a20b9db0b691644e8345
SHA512 ee394d57433eddec153b43642c39f2ddec58363febe4019d8a88eb2c250021d21307bdfaa8a1152dc8bec5c0e10340c08ad421aab897855632ad3fdc749f8f7b
SSDEEP 1536:khLXh2urc2GsHn6rHmrMEmg8JnergMTsbjNMkLSXPPkL5z3QGvFIXQKYajxuczqE:Ml39c1rJerlAjLLSfPk5ZtIXQqxu247e
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut568D.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut568D.tmp
Size 9KB
SHA256 4548c17225d44baa69af546ee7a32fdef956f2609b036aefa8fc7b53d8f46bb9
MD5 5cdfe0206be06473c6c20861bad954d1
SHA1 63fcc3d497eaa93a718db0b19e96a22c42e1baa9
SHA512 a1df409c32ec80d93c6a2a49dad77842c6a6a3569ba29ecadc1c307834f70b6e509211c3926f80a31e0bf198803ccb7e3b03b1f8c5ebc9883154393c8b91fc2a
SSDEEP 192:Q09SJLZ7jNO7shu7mGe92nsxZhscNO6YWNOYu6d3anAdonLDfGUlDg4F8Tijbqh3:z9SJtjEsesZttw/6dqn/LD446TUbk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

quinquenniad

Path C:\Users\Admin\AppData\Local\Temp\quinquenniad
Size 104KB
SHA256 38426767d63239e13a58a87d62b4807bae9eea667d9068b4714f2311c9dc1211
MD5 2a3fae94cf4e27693093ad1ecb8f8cc4
SHA1 8c8d368adc6aa7969576eea9d56f9efc15d0a6e3
SHA512 31d1ca4da064e3e8ae644a4fd90c2f4fa4188241412d3ad7825abaaf25aaf5f03f0ee00922f6e028233e23c1b1219e6c0561853a0f386e25b7188f59974588c2
SSDEEP 1536:Ar5mSPZqFxjAjAksoZQEiyZJBNFje8s5/AD98v0P3szJE1dgM:XSPZq3AkCJhjfs5S8sP8NCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snaith

Path C:\Users\Admin\AppData\Local\Temp\snaith
Size 29KB
SHA256 5c20222ccdb89aea34057dab4f26c74746ea4877563ca4cbb32923818ccd4966
MD5 54e23b14d3dd610585ac9e39b4362df0
SHA1 f3657a3af1565fd5ea246ea4e58888685bc2b663
SHA512 6060267d2525856cd329c5c3f7ba770adc5bca111b48bf83f854392f17b7dbc61516aa6493295f4c021e489087919429848c6ed21ef07d728578058492c9a830
SSDEEP 768:G3i/fbiPVzVGhdEOMIxWwp5JV65qLe6l1dfnc1uLphM:Uin+PVYbEOdKuLDM
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_1d8b510d-d32c-42bd-9a91-b82cb6ed494a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1232405761-1209240240-3206092754-1000\0f5007522459c86e95ffcc62f32308f1_1d8b510d-d32c-42bd-9a91-b82cb6ed494a
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_1d8b510d-d32c-42bd-9a91-b82cb6ed494a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1232405761-1209240240-3206092754-1000\0f5007522459c86e95ffcc62f32308f1_1d8b510d-d32c-42bd-9a91-b82cb6ed494a
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

memory/3848-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3848-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3848-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3848-83-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3848-91-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4112-10-0x0000000002EC0000-0x0000000002EC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads