lokibot | 3d013ade0afd70874b75e9190f63a98290b544467c5867a6d3048ea105e7252c

General

Target

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
Size

243KB
MD5

275021d22c37a2e2f124512f67948f02
SHA1

e9fc6d024577a20cb52c491a71fb7bd8a654ad70
SHA256

3d013ade0afd70874b75e9190f63a98290b544467c5867a6d3048ea105e7252c
SHA512

24f8c368abf1421d0b0a2755f6115f14bad2bf16c44d5226cbafd657001c4faee96140ec4830a291e0f62368928d2a24c357110b06e100dd9d2b0a8b01ca323e
SSDEEP

3072:JIdKU+VGUzdMinPradcljSPQR3Wqt5D5m4BxNWJoEPE9I:idKU+VXxnedclOPQRRNm4fItq

Score

10^/10

lokibot collection spyware stealer trojan upx

Malware Config

Extracted

Family

lokibot

C2

http://richiechris.cf/wp/wp-content/oko/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4184-0-0x0000000000380000-0x00000000003FD000-memory.dmp	upx
behavioral2/memory/4184-1-0x0000000000380000-0x00000000003FD000-memory.dmp	upx
behavioral2/memory/4184-2-0x0000000000380000-0x00000000003FD000-memory.dmp	upx
behavioral2/memory/4184-4-0x0000000000380000-0x00000000003FD000-memory.dmp	upx
behavioral2/memory/4184-32-0x0000000000380000-0x00000000003FD000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	pid	process	target process
PID 4184 set thread context of 616	4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

pid	process
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

pid process

4184 275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

pid process

616 275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 616 275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

pid	process
616	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	616	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	pid	process	target process
PID 4184 wrote to memory of 616	4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
PID 4184 wrote to memory of 616	4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
PID 4184 wrote to memory of 616	4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
PID 4184 wrote to memory of 616	4184	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

outlook_office_path 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

outlook_win_path 1 IoCs

Processes:

275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\275021d22c37a2e2f124512f67948f02_JaffaCakes118.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\0f5007522459c86e95ffcc62f32308f1_2397ee06-28fe-4eaa-8777-f7014368c353

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/616-30-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/616-31-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4184-20-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-1-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/4184-19-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-6-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-29-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-28-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-27-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-26-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-25-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-24-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-23-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-22-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-21-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-0-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/4184-4-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/4184-17-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-5-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-16-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-15-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-14-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-13-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-12-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-11-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-10-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-9-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-8-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-7-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-3-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4184-2-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/4184-32-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/4184-18-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads