lokibot | dc17496f619e7a6c9b6fc7392fc8448434bb6b43ecf25431e997be9e7f75fd06

General

Target

3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
Size

537KB
MD5

67eb26d7f0aaa1e001828b5d2bfae149
SHA1

364524ec9b431c4bb82f7e2c31480275c82133d8
SHA256

3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0
SHA512

58edb5e7d57603f9f653a8ccc4e4e65aa62f207aaab59a4d87caabe30f3f927e80f6d2954744180a84ea3bed2c5870892e342193d30d90f694260432eb9c3e96
SSDEEP

12288:HbBPJwKcI5JG/d4m5wg3SRV1RUHsuVK+BEL1D1X5OlK0QK0mV91H:7BhcsGV4YSRV7fuVKdbOl+Kx3

Score

10^/10

lokibot collection execution spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d10/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe
2644	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
2644	powershell.exe
2640	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2552	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2552	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2640	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	28
PID 2884 wrote to memory of 2640	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	28
PID 2884 wrote to memory of 2640	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	28
PID 2884 wrote to memory of 2640	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	28
PID 2884 wrote to memory of 2644	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	30
PID 2884 wrote to memory of 2644	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	30
PID 2884 wrote to memory of 2644	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	30
PID 2884 wrote to memory of 2644	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	30
PID 2884 wrote to memory of 2596	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	31
PID 2884 wrote to memory of 2596	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	31
PID 2884 wrote to memory of 2596	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	31
PID 2884 wrote to memory of 2596	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	31
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34
PID 2884 wrote to memory of 2552	2884	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe

C:\Users\Admin\AppData\Local\Temp\3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
"C:\Users\Admin\AppData\Local\Temp\3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BoSsLH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BoSsLH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp61B0.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe
  "C:\Users\Admin\AppData\Local\Temp\3b0af3f5146f9d1461b10e6535dc47bea08ae7f8f728542aaba25e5cc8d914e0.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp61B0.tmp

Filesize
1KB

MD5
cf7dd8cf5873e14699add66317a3306b

SHA1
02fa3ab0f38a5b86be6b9ce2771f5ddfe5503c32

SHA256
7e220c26c2c5b47de8247493308125dadb8cb3ce3182ebcc3742bb1369d22739

SHA512
4e7b886987a3319c23d666b7b5052de5c23faa6772c1be0e066bf397bb631e788dc79c7457d6405bcf999a72fe5e0ef40f0ec64cc6833a82e8180af1196a8bc5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\0f5007522459c86e95ffcc62f32308f1_63be8c66-23f0-4400-84bb-c1a439222555

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CVIIBITMCRQA4CO3G9PT.temp

Filesize
7KB

MD5
e66edde6f6fd79710a712672bbf5a16f

SHA1
9c176cf100e1b992c088c3b8623d0707cb1ddf33

SHA256
c812dab44f6adbe39d42b22e3c0eda584ebf0032a1f8e4018ca7f6fddfd229bd

SHA512
b6099ac9868a87b3d4ff32bbd2b800eacaeb88aea7569d3682143795be702c4ae5cbe8c98643b334fc9dca8b3678938f8654f84deba869ff375691dfffb5578f

Download Submit
memory/2552-20-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-26-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-59-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-50-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-18-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-22-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-30-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-29-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2552-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-24-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2884-5-0x0000000000E50000-0x0000000000EB2000-memory.dmp

Filesize
392KB

Download
memory/2884-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2884-31-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-2-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-1-0x0000000000EE0000-0x0000000000F6C000-memory.dmp

Filesize
560KB

Download
memory/2884-3-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/2884-4-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads