lokibot | 275c247709cfde6339f444b9386d64cb8199378dec6cc20ab2452df375531532

General

Target

c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
Size

498KB
MD5

c661e6f45eb379feaa96f165b3bf255a
SHA1

ceeb07862ddeee88b61146007375d517584c883c
SHA256

275c247709cfde6339f444b9386d64cb8199378dec6cc20ab2452df375531532
SHA512

6798e31ec52bef5bf502e17e7ae124d8d1345196d8e3369cb1a29ae8a5e42e28e639b465866fad3c6a53ba4945d7c59b75964d281223feb237c7712107e87918
SSDEEP

12288:eV0n+TLGxS6kORFtH92tKyuzgtv4i8+iHWEyq:e6e63RFt4Yyuzgtv4i8+i

Score

10^/10

lokibot discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://89.34.237.212/annonymous/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Baddest.Ol9Qb974u7738Mkd.lnk	Baddest.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	Baddest.exe
2648	Baddest.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	Baddest.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2648	2868	Baddest.exe	32

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	Baddest.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	Baddest.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baddest.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
Token: SeDebugPrivilege	2868	Baddest.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 960	1944	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe	29
PID 1944 wrote to memory of 960	1944	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe	29
PID 1944 wrote to memory of 960	1944	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe	29
PID 1944 wrote to memory of 960	1944	c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe	29
PID 2876 wrote to memory of 2868	2876	explorer.exe	31
PID 2876 wrote to memory of 2868	2876	explorer.exe	31
PID 2876 wrote to memory of 2868	2876	explorer.exe	31
PID 2876 wrote to memory of 2868	2876	explorer.exe	31
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32
PID 2868 wrote to memory of 2648	2868	Baddest.exe	32

C:\Users\Admin\AppData\Local\Temp\c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c661e6f45eb379feaa96f165b3bf255a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Local\Baddest.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Baddest.exe
  "C:\Users\Admin\AppData\Local\Baddest.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Baddest.exe
    "C:\Users\Admin\AppData\Local\Baddest.exe"
    3⤵
    - Executes dropped EXE
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Baddest.exe

Filesize
498KB

MD5
c661e6f45eb379feaa96f165b3bf255a

SHA1
ceeb07862ddeee88b61146007375d517584c883c

SHA256
275c247709cfde6339f444b9386d64cb8199378dec6cc20ab2452df375531532

SHA512
6798e31ec52bef5bf502e17e7ae124d8d1345196d8e3369cb1a29ae8a5e42e28e639b465866fad3c6a53ba4945d7c59b75964d281223feb237c7712107e87918

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

Filesize
478B

MD5
eb81a2f1f2a040987e2eb70e71eddc92

SHA1
85fafae30d110ddd7485827cd97457aaba82cab2

SHA256
c7caf1b9e25a8cee450782b02757c78a2bdfc2efe06e59c55dbd6dca237221a2

SHA512
183fd40acf644be81f0bdfa3745211fc3c22d0a65718ecea779e302740c81c1ffe1c61824cca2277cb67c8f40e05bc9e69e094e9823af3197f7c8c1cbef516c2

Download Submit
memory/1944-0-0x00000000748B1000-0x00000000748B2000-memory.dmp

Filesize
4KB

Download
memory/1944-1-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-2-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-3-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1944-9-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-18-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing