lokibot | e8f587c973bb2b5185385665dd4b34da8839e2a941e2bb72d4398d2fbba6fdc3

General

Target

0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
Size

351KB
MD5

0ec671099338a885ecf699354bd327e1
SHA1

b970b226ae75b9c41c4680172ebb39192e079727
SHA256

e8f587c973bb2b5185385665dd4b34da8839e2a941e2bb72d4398d2fbba6fdc3
SHA512

e4f9caae68e33e0efdbbb7ae1079556b2a771c2cfe5a8a7ec6538bf649d0d37f6902104f0dbc96b03e1d3129b13091943398575a87d2c96502dc5d8c8ad15cbf
SSDEEP

6144:mOijv8/XTkGxI6tca+uO89W8P7d112msqDGYOU:mcfDxI4ca+udI8J1lDpx

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://primausaha.net/uv/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe

description pid process target process

PID 2344 set thread context of 2596 2344 0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe

pid process

2344 0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
2344 0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0ec671099338a885ecf699354bd327e1_JaffaCakes118.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2344 0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
Token: SeDebugPrivilege 2596 RegAsm.exe

description	pid	process	target process
PID 2344 set thread context of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe

pid	process
2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
Token: SeDebugPrivilege	2596	RegAsm.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

0ec671099338a885ecf699354bd327e1_JaffaCakes118.execsc.exe

description	pid	process	target process
PID 2344 wrote to memory of 2860	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	csc.exe
PID 2344 wrote to memory of 2860	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	csc.exe
PID 2344 wrote to memory of 2860	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	csc.exe
PID 2344 wrote to memory of 2860	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	csc.exe
PID 2860 wrote to memory of 2132	2860	csc.exe	cvtres.exe
PID 2860 wrote to memory of 2132	2860	csc.exe	cvtres.exe
PID 2860 wrote to memory of 2132	2860	csc.exe	cvtres.exe
PID 2860 wrote to memory of 2132	2860	csc.exe	cvtres.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe
PID 2344 wrote to memory of 2596	2344	0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe	RegAsm.exe

outlook_office_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegAsm.exe

outlook_win_path 1 IoCs

Processes:

RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec671099338a885ecf699354bd327e1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1io2fgnm\1io2fgnm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES190C.tmp" "c:\Users\Admin\AppData\Local\Temp\1io2fgnm\CSCDF87514F38D45A6AD516DAE3FB6D5A6.TMP"
    3⤵
    PID:2132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1io2fgnm\1io2fgnm.dll

Filesize
6KB

MD5
aad49963ea4480e55360243837414db8

SHA1
9ce8586c6cabf440918c08f7e2e9b08daa48f8c0

SHA256
19a00da297a8a204dcdaecb6e2f34c0daf31f58a8ac0f2c1533264c3bb86679e

SHA512
1a6b463a1437dc1c0baf0ab19865bc771e638c0dce7260b92d8700cfb47e4156ca08bf164ae05ac5fb3ac5bc86fd8a756d99e3ce588104a73f984f9f81616fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1io2fgnm\1io2fgnm.pdb

Filesize
17KB

MD5
bfe83fab2f81b841f9fe7df31897e177

SHA1
b50440cbb4bb1ae6aba0f5c2e31e3d9ce3b76b78

SHA256
e9b36ab1cb9faf731d186837ad2ba5c6188545ba23efd8eb18eaee90179d873d

SHA512
03e3636ddb463cfb9ee923d0d5f33e8b61e2785bcf03ecfa8b102ab0d82eea417a904fff4ae50dfa28877487e949397e461f58974636499f822fbe6266367af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES190C.tmp

Filesize
1KB

MD5
090149a1a590fa3d2eef5e95caf29c9b

SHA1
edaa4f03cf7b71cd47ca4b5bab1b4eb8f7caae03

SHA256
de248fddcb4102313638d3bf316cfcfe27db7bc19f1d81c2d52c5b41ebd4176e

SHA512
103d74207c973ee1250c55b46b20bc81b2102a97545ee52c9690859a4ce4d6ea94b3161934496f5511ceb0230b70750c134fa368d469dfc0f10d52149ec9f050

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1io2fgnm\1io2fgnm.0.cs

Filesize
3KB

MD5
f12c78a72c80344348e4a53d82082b20

SHA1
5a0faca1772ce426a0f8518fe07032e2c5b9fe6c

SHA256
dad0a8f3eb677d3f13f7312f01de0a40b4553dbc172c9a31b482fb106ed8254f

SHA512
2f03239cd5315336edb0deaed8ee05fa00ca534471a566089c0aadb6746984ca25a1c69e76c55f2820a97950f41c48cd009c7fe9ab382a90ef42bddaa70b1353

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1io2fgnm\1io2fgnm.cmdline

Filesize
312B

MD5
ee16c748f2f1e95a37509abcdaa1344b

SHA1
260a9cb3d73eecce018e00f5a92614f7c1f94376

SHA256
21778a2bd85b2f172d2304666cff17db86e6341bc6f68f18ac642f167cecb0fd

SHA512
0f2c1346ad863422b83adae825b40a5812230285b6f3f4dc572cbdbbd308531e4c25d40b74b052c7dadb49a8761a53882c184437ecdb53e3249a6f3ea9fca1de

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1io2fgnm\CSCDF87514F38D45A6AD516DAE3FB6D5A6.TMP

Filesize
1KB

MD5
dfa0d0dcda9782525401e5a9f3315190

SHA1
8b1ba33677c1f03170ba4546454fc20c150e1c8b

SHA256
f8b01e549925b0d6c25b4d4f70a3b5d932107874489580a5e0a93deba87b4454

SHA512
1a508d497f351bc768aba540cec5258ecd6da63dda499a2d28c1803e4902bcdf0fe7c0ef5c81250bdf5d0b909699eb1aab3bd6da41df32f1143ffc55c36150da

Download Submit
memory/2344-21-0x0000000000620000-0x00000000006C2000-memory.dmp

Filesize
648KB

Download
memory/2344-17-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2344-19-0x0000000000420000-0x000000000044A000-memory.dmp

Filesize
168KB

Download
memory/2344-20-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2344-0-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2344-1-0x0000000000A60000-0x0000000000AA6000-memory.dmp

Filesize
280KB

Download
memory/2344-5-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-34-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2596-33-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-23-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-31-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-25-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-38-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-22-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-27-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2596-77-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads