lokibot | cffe7a8e861c15dcfce2fd77a1106ba7a726cc84d1d5d4bcf81a7ebc4797ce5f

Analysis

max time kernel
136s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe
Size

919KB
MD5

59b5dfa722dbe47830538a201c9b483e
SHA1

513295d3c19c5d20595882945f05365c971d2dba
SHA256

cffe7a8e861c15dcfce2fd77a1106ba7a726cc84d1d5d4bcf81a7ebc4797ce5f
SHA512

fcd462033651f4e5a53fd63468332b088dccd973f8052edfc0f97ead47966ff2909e6a1ac5d3d7a8fe7cbc614c9c78074f81e72c65978a9a7de74ca0897eeaf5
SSDEEP

12288:4NM16jETzcPhBr48Jbfebtq7Nf5LAXsyR1LwenQxIQFUtvUhmZvfi7wPqGTAQMT:+M16jGqBr48JZ7PEnsNIN8mwwbT1K

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://mxc.igg.biz/022/cgi.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe

description pid process target process

PID 4140 set thread context of 3472 4140 59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 3472 svchost.exe

description	pid	process	target process
PID 4140 set thread context of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe

description	pid	process
Token: SeDebugPrivilege	3472	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe

description	pid	process	target process
PID 4140 wrote to memory of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe
PID 4140 wrote to memory of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe
PID 4140 wrote to memory of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe
PID 4140 wrote to memory of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe
PID 4140 wrote to memory of 3472	4140	59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe	svchost.exe

outlook_office_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59b5dfa722dbe47830538a201c9b483e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/3472-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3472-10-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3472-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3472-32-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4140-0-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4140-1-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4140-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4140-9-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download