lokibot | 5b25ccbadce2536b0b89cbc7db98ad273b04b8f9f6589798f1c61197977db3d6

General

Target

458174931094fea9a1b924440f0125e6_JaffaCakes118.exe
Size

600KB
MD5

458174931094fea9a1b924440f0125e6
SHA1

3f71331342f04184e4aea0cd95ed341306d570db
SHA256

5b25ccbadce2536b0b89cbc7db98ad273b04b8f9f6589798f1c61197977db3d6
SHA512

a95f4bc50636e1397fdb1b44d5a57412f5f99358a24be650baa07cf2b9c4f98e5d81228bfa86c25c07318cf858bab548785f4fc631ad4eca9616a54ec0907cc2
SSDEEP

12288:jWcp8wkfBN7LLf50z1S2a34Yuc0k7x0MvfbQGWTd:qcGfDxO24Yuc0Ax0MvjQ/

Score

10^/10

lokibot collection persistence spyware stealer trojan upx

Malware Config

Extracted

Family

lokibot

C2

http://abscete.info/sinzu/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Executes dropped EXE 2 IoCs

Processes:

TVcard.exeTVcard.exe

pid process

2344 TVcard.exe
2664 TVcard.exe
Loads dropped DLL 2 IoCs

Processes:

458174931094fea9a1b924440f0125e6_JaffaCakes118.exe

pid process

2116 458174931094fea9a1b924440f0125e6_JaffaCakes118.exe
2116 458174931094fea9a1b924440f0125e6_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2344	TVcard.exe
2664	TVcard.exe

pid	process
2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe
2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2116-0-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/2116-12-0x0000000000400000-0x000000000053F000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

TVcard.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	TVcard.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	TVcard.exe
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TVcard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TVcard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mozilla = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\StatsReader.exe"	TVcard.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TVcard.exe

description pid process target process

PID 2344 set thread context of 2664 2344 TVcard.exe TVcard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TVcard.exe

description pid process

Token: SeDebugPrivilege 2664 TVcard.exe

description	pid	process	target process
PID 2344 set thread context of 2664	2344	TVcard.exe	TVcard.exe

description	pid	process
Token: SeDebugPrivilege	2664	TVcard.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

458174931094fea9a1b924440f0125e6_JaffaCakes118.exeTVcard.exe

description	pid	process	target process
PID 2116 wrote to memory of 2344	2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe	TVcard.exe
PID 2116 wrote to memory of 2344	2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe	TVcard.exe
PID 2116 wrote to memory of 2344	2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe	TVcard.exe
PID 2116 wrote to memory of 2344	2116	458174931094fea9a1b924440f0125e6_JaffaCakes118.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe
PID 2344 wrote to memory of 2664	2344	TVcard.exe	TVcard.exe

outlook_office_path 1 IoCs

Processes:

TVcard.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TVcard.exe

outlook_win_path 1 IoCs

Processes:

TVcard.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	TVcard.exe

C:\Users\Admin\AppData\Local\Temp\458174931094fea9a1b924440f0125e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\458174931094fea9a1b924440f0125e6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\TVcard.exe
  "C:\Users\Admin\AppData\Local\TVcard.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\TVcard.exe
    "C:\Users\Admin\AppData\Local\TVcard.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\F.bmp

Filesize
384KB

MD5
a7c7d6975d10357ce031ac13ddd661b8

SHA1
d480851439f8a82b802f542a82e3ef29fd5055a8

SHA256
4acc0a93b420c8080f1f08fe833855f6ccba084a17e86f3f127f30914dd45eac

SHA512
8affe6189b9a38e360f1aa435c1e060a17071902be58bad108b42a08f73d54d6abda67c2cbab41531b11391074862ab59cda9ab4b619971238da47124bc6f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-481678230-3773327859-3495911762-1000\0f5007522459c86e95ffcc62f32308f1_62d00eb3-39d9-4013-96e4-e92894ec756e

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-481678230-3773327859-3495911762-1000\0f5007522459c86e95ffcc62f32308f1_62d00eb3-39d9-4013-96e4-e92894ec756e

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
\Users\Admin\AppData\Local\TVcard.exe

Filesize
89KB

MD5
189ce270d71588bf34ea0ece0f8d3d1e

SHA1
06665bfdf86209b8c4dc00f3a19f01379919a6fc

SHA256
9ef0992833468166d8c1774e1ab4808b094d7cf026dacfb760159336385ff4ab

SHA512
e64a8a755b1c052adddb04d99fc7464a6029012d954a645334cc5ca806f1183984878c141df596ab5e7843ba762da7c6da19bc621fef8722c03bc26e15d86915

Download Submit
memory/2116-0-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/2116-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2116-12-0x0000000000400000-0x000000000053F000-memory.dmp

Filesize
1.2MB

Download
memory/2344-31-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2664-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-22-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-20-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-29-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-30-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-25-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-18-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-50-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2664-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads