lokibot | 550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091

General

Target

550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091.js
Size

114KB
MD5

676083473f1cbd772fbb9560aaa6d78f
SHA1

6996d14b646f30f2db921a14f7cb022075b66b7a
SHA256

550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091
SHA512

c2d9ad8ceea7a3f2a905a3e80b867fc1cc6e49407540f7e607bd021633ff9063b0b553672d098d4a30d715237cafb744ed4dd232ff0feef879be706c9c00e0a8
SSDEEP

3072:7zbLWB/sJtttttttttttttttttttattttttttttttttttttttn0ZlDrOm1tttttW:OB/m7iT

Score

10^/10

lokibot collection credential_access discovery execution spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://werdotx.shop/Devil/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3452	x.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3452 set thread context of 2284	3452	x.exe	89

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	x.exe
Token: SeDebugPrivilege	2284	Caspol.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3452	3344	wscript.exe	84
PID 3344 wrote to memory of 3452	3344	wscript.exe	84
PID 3344 wrote to memory of 3452	3344	wscript.exe	84
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89
PID 3452 wrote to memory of 2284	3452	x.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Caspol.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
60KB

MD5
3beeb3726e4363c5bd33cab9865a799a

SHA1
bb0d6483030e5557145cd38c3ea71129b3d201a0

SHA256
74837dc749f77e6fe41b9d41278a19b3a1990a31731c87e7327528d27e0a2fac

SHA512
d5658c54f916934ddaadd794fb21a7c2f8abd6187cb7a9fc2733e69a6ccda5c48b2fa9c1d33fbb3066c981f882e3c42eab188cbffc27c94bafaada7777cd42f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/2284-21-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2284-50-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2284-42-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2284-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2284-19-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3452-13-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3452-20-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3452-15-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3452-14-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/3452-12-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/3452-11-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing