lokibot | 9e931ddc070e0c5be9b565479a298449f8c38a686472774386d5a3a402b4eee6

General

Target

3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe
Size

386KB
MD5

3e68d38b9687d6d947711d1105076a1a
SHA1

f7b7e51adbd2ad3830b23ba1047b2ff06662ef3c
SHA256

9e931ddc070e0c5be9b565479a298449f8c38a686472774386d5a3a402b4eee6
SHA512

76cc87ccf6d6d8e2c56c4a778f17b1d3a3904714d4ac861f9b99e75eaf3c1191073a0ae3c2352e8b86cd2966ecb591082d87b7e64f577204f668c34a7360dd13
SSDEEP

3072:Wq9dGWohBHIQ9se3BhHI7+vFP28A7eq1PAJ74Icry78/w/PM4mMyJvPaZESu:YqQOkBlIwFP87TARcikH1v+Er

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://ipqbook.com/shalom/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe
3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe
Token: SeDebugPrivilege	3612	vbc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 668	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	84
PID 3604 wrote to memory of 668	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	84
PID 3604 wrote to memory of 668	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	84
PID 668 wrote to memory of 1368	668	csc.exe	87
PID 668 wrote to memory of 1368	668	csc.exe	87
PID 668 wrote to memory of 1368	668	csc.exe	87
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89
PID 3604 wrote to memory of 3612	3604	3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Users\Admin\AppData\Local\Temp\3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e68d38b9687d6d947711d1105076a1a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0oi03sdw\0oi03sdw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5822.tmp" "c:\Users\Admin\AppData\Local\Temp\0oi03sdw\CSC5E05B3953A024969B4A05E57D1BDD9C.TMP"
    3⤵
    PID:1368
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0oi03sdw\0oi03sdw.dll

Filesize
6KB

MD5
1660a5988037f2d9b729b99822359a48

SHA1
a2cf020294ccc6b54b36734c91907a8ffdacaa5e

SHA256
ce463e641a3e8f581469c7c408a4511bbf30729793cfba6e53d2284a51a400a4

SHA512
e5dae5461ded80180590ed15fb3e9663311355ee541830e7f49e9e4101909c9e75602a70666e8450cf18d170a585fb12a909efb89c1fed7919a06b1a7e425464

Download Submit
C:\Users\Admin\AppData\Local\Temp\0oi03sdw\0oi03sdw.pdb

Filesize
15KB

MD5
c39e442f4f0f5de7d73ee817b55aae23

SHA1
0c0d05de0da0dbea6d9269cb94fa1df3aac1c31b

SHA256
72075f6e4204cc57d42518d2d4f47222aa1fbc972e8797a17df6a4f031422ce6

SHA512
f026d80ba2b224fb40210f40a00d25fea008a8e054778b6c0e965252bf0a33426e7669291b098b96482dcd0601b6aad9370d3d6ba7dee9d2a479637b76a9cf7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5822.tmp

Filesize
1KB

MD5
877f6e42f5a44fecd07efc8e5979040e

SHA1
c2ddeed862ae647929d912147f88ea26bef4cdf7

SHA256
83fc54016770264d3450b023fd2e1fcd252851e909a85fbaad52147253821f04

SHA512
d39e0863928678642e4ee2b439954ed5c1db04e2e15824ff873ae7b3027ff07dfee4816cb913002bbae0358f4702c82017039c69a69c945b8b9c68eeb11297f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0oi03sdw\0oi03sdw.0.cs

Filesize
3KB

MD5
acd90e63e3c3dd828a38c35d4d04c217

SHA1
d2ad739301ed7a4e383a9088e30c90807aab1fdc

SHA256
566ac420eec1621de73618368b08d9063984723302bd455b86b60c82a5f359e8

SHA512
2b310b2c4f1059a936b679d3597de50eb87df2706a5575dfb92c6bf3a72cee246bb9d5de60fb9d4b90fb52378097f5703f9abed6fa5d407950472648b8977539

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0oi03sdw\0oi03sdw.cmdline

Filesize
312B

MD5
885cc6b24bc9658afd748021689f18bf

SHA1
485bf0aacc04d9ef1d08f9e9a19f280bf25222a8

SHA256
9648cee5ce7764ae63032e95d0b27dd080d6968a67c7747b692e1361b1555fda

SHA512
d0e6b99456b9eb266dad436186ee63bfded2b69692ead60717ccfd7bde6e10da1aaf319487f39006b3673769ffc55c3ea6cd8fa32fb443e434abf21a937cb758

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0oi03sdw\CSC5E05B3953A024969B4A05E57D1BDD9C.TMP

Filesize
1KB

MD5
ac5e52a70df45f0f3fff390ab9908fa2

SHA1
c4e3554b8a67988a5537c18c0117ab60d03dc8b5

SHA256
7efd9b7e7438ed53a875b46cb98f508acc580b77936e720b3a89513253311cce

SHA512
9a1ab5af56d715431bd82e32859a97c119209648c492f8147dbfd78229562b0ebdb7e5e62dddbf6fe96e1b0965b28ea57533921ed8cb9f0fed597e020f45db6b

Download Submit
memory/3604-24-0x0000000005EE0000-0x0000000005F7C000-memory.dmp

Filesize
624KB

Download
memory/3604-29-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3604-3-0x0000000005760000-0x0000000005768000-memory.dmp

Filesize
32KB

Download
memory/3604-19-0x0000000005770000-0x0000000005778000-memory.dmp

Filesize
32KB

Download
memory/3604-21-0x00000000058C0000-0x00000000058EA000-memory.dmp

Filesize
168KB

Download
memory/3604-23-0x0000000005920000-0x00000000059C2000-memory.dmp

Filesize
648KB

Download
memory/3604-4-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3604-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/3604-22-0x00000000058F0000-0x00000000058FC000-memory.dmp

Filesize
48KB

Download
memory/3604-1-0x0000000000F20000-0x0000000000F54000-memory.dmp

Filesize
208KB

Download
memory/3604-2-0x0000000005780000-0x0000000005812000-memory.dmp

Filesize
584KB

Download
memory/3612-25-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3612-30-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3612-28-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3612-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing