lokibot | 465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633

General

Target

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Size

344KB
MD5

1b023b6f6a4447cd8c2d8e841f542227
SHA1

397af11ba7d160ab76f3099798257c057790280a
SHA256

465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633
SHA512

3326329715fc325a712607b59204a17ec1f8d19868fc644ec1fe282b5c5e40577faff17c372e1c2ab885a9f37d96e09afee4e5ca27b424f3e10140b1b7cd8150
SSDEEP

6144:fWNdxridQv5Rzh+uSrEga5GJvh4BTFWSPEhaxso8zM2bGgWzRXEGPLyhq9rf7qu5:udxed4guKEge2vh4BTFWwCo0M2bEzRXn

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://kamatecpark.com/~zadmin/lmark/emma/link.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Loads dropped DLL 2 IoCs

Processes:

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid process

1724 1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
1724 1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid	process
1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

nslookup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nslookup.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	nslookup.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nslookup.exe

Drops file in Windows directory 1 IoCs

Processes:

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\win.ini 1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid process

1724 1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid process

1724 1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nslookup.exe

description pid process

Token: SeDebugPrivilege 50352 nslookup.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid	process
1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

pid	process
1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	50352	nslookup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe

description	pid	process	target process
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe
PID 1724 wrote to memory of 50352	1724	1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe	nslookup.exe

outlook_office_path 1 IoCs

Processes:

nslookup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nslookup.exe

outlook_win_path 1 IoCs

Processes:

nslookup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:50352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Windows\win.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\nstA5F.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\shwa.dll
Filesize
23KB

MD5
e9f0406091c6e24979d02df7e6af742c

SHA1
2962e5b0043d6bcd777be53877fba3e6ade3dbe5

SHA256
a134f9624f6f880bfd2ba5b242e519961af92de5d22733892fe2373e0083ffd4

SHA512
45db0bce7c6f165fa15597d70e7da7abff0cb0e824a44f2516809157177ca7ccda0ddd0e2c74ba10be657be94700bb9d2ad81399143be94166802590ce74f5d2

Download Submit
memory/1724-15-0x0000000000C00000-0x0000000000C13000-memory.dmp

Filesize
76KB

Download
memory/1724-68-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1724-67-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1724-100023-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1724-100024-0x0000000077B90000-0x0000000077D39000-memory.dmp

Filesize
1.7MB

Download
memory/50352-100025-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/50352-100028-0x0000000077B90000-0x0000000077D39000-memory.dmp

Filesize
1.7MB

Download
memory/50352-100039-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/50352-100027-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/50352-100026-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/50352-100083-0x0000000000090000-0x0000000000095000-memory.dmp

Filesize
20KB

Download
memory/50352-100084-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads