lokibot | 34f9dfcc766eaba14087b30209c5eb8856f7cbea2600f71f4e31eaab85d3db0b

Analysis

max time kernel
146s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Size

2.2MB
MD5

eeaa7f99337e043d590cc21b4e24eece
SHA1

a517be28d8fbc2a5c4c91ef27c55bff3fa9e6baa
SHA256

34f9dfcc766eaba14087b30209c5eb8856f7cbea2600f71f4e31eaab85d3db0b
SHA512

66270f0fd598b38227697198cd2d33eb9fd2f07aa9e5ee8b07554d9ec4b90f6886985b5f3a1beef634efb4fd25379d161e1974a529f3dfcc79454dc4fe9a1b55
SSDEEP

24576:fadJQrQVLRMYZJk9kFvk+6mADR8To1Vzh3KFHtqneNrzjzfA5a5pU9aOXUP2brPy:f3rqUK8dDjh3QN8ic4+UOb4RueGlWOBS

Score

10^/10

lokibot xtremerat collection credential_access discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xtremerat

frigetraassse3.net

Extracted

Family

lokibot

http://lagenceengineering.com/wp-includes/fonts/app/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Detect XtremeRAT payload 14 IoCs

resource	yara_rule
behavioral1/memory/2096-4-0x00000000049E0000-0x0000000004A9C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-9-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-15-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-16-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-17-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-14-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-11-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-10-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-8-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-7-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/1688-26-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/2452-30-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/2452-32-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat
behavioral1/memory/3056-40-0x0000000000C80000-0x0000000000D3C000-memory.dmp	family_xtremerat

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	vbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4QGI7678-00JC-E7DQ-T0Y1-70UK63HV761N}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3000	876lkk.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 3000 set thread context of 2936	3000	876lkk.exe	36

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\	vbc.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	vbc.exe
File created	C:\Windows\InstallDir\Server.exe	vbc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	876lkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
3000	876lkk.exe
3000	876lkk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
Token: SeDebugPrivilege	3000	876lkk.exe
Token: SeDebugPrivilege	2936	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2452	explorer.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 2096 wrote to memory of 3056	2096	eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe	31
PID 3056 wrote to memory of 1688	3056	vbc.exe	32
PID 3056 wrote to memory of 1688	3056	vbc.exe	32
PID 3056 wrote to memory of 1688	3056	vbc.exe	32
PID 3056 wrote to memory of 1688	3056	vbc.exe	32
PID 3056 wrote to memory of 1688	3056	vbc.exe	32
PID 3056 wrote to memory of 2976	3056	vbc.exe	33
PID 3056 wrote to memory of 2976	3056	vbc.exe	33
PID 3056 wrote to memory of 2976	3056	vbc.exe	33
PID 3056 wrote to memory of 2976	3056	vbc.exe	33
PID 3056 wrote to memory of 2452	3056	vbc.exe	34
PID 3056 wrote to memory of 2452	3056	vbc.exe	34
PID 3056 wrote to memory of 2452	3056	vbc.exe	34
PID 3056 wrote to memory of 2452	3056	vbc.exe	34
PID 3056 wrote to memory of 2452	3056	vbc.exe	34
PID 3056 wrote to memory of 3000	3056	vbc.exe	35
PID 3056 wrote to memory of 3000	3056	vbc.exe	35
PID 3056 wrote to memory of 3000	3056	vbc.exe	35
PID 3056 wrote to memory of 3000	3056	vbc.exe	35
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36
PID 3000 wrote to memory of 2936	3000	876lkk.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Users\Admin\AppData\Local\Temp\eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeaa7f99337e043d590cc21b4e24eece_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\876lkk.exe
    "C:\Users\Admin\AppData\Local\Temp\876lkk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\876lkk.exe

Filesize
655KB

MD5
a27864f20c8a30f578f06e329187726c

SHA1
0ed25fa987698b65ecd280eee2b84b9f8abe98a7

SHA256
ac14b5cdad4964d720eb02bea586821d82997d281a1aad5bb4f70a8a460873c8

SHA512
d9c794b173cd1629d936cf4d67f5184848e7b6f56ed25ec6093419aed675e3b06957f50260781afa33818938d80a7def7cc663237d8433d44b441b86bdab07b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4177215427-74451935-3209572229-1000\0f5007522459c86e95ffcc62f32308f1_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4177215427-74451935-3209572229-1000\0f5007522459c86e95ffcc62f32308f1_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/1688-26-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2096-1-0x0000000000900000-0x0000000000B26000-memory.dmp

Filesize
2.1MB

Download
memory/2096-2-0x0000000000790000-0x0000000000852000-memory.dmp

Filesize
776KB

Download
memory/2096-3-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2096-4-0x00000000049E0000-0x0000000004A9C000-memory.dmp

Filesize
752KB

Download
memory/2096-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

Filesize
4KB

Download
memory/2452-32-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2452-30-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/2936-47-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-45-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-108-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-94-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-79-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-57-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-56-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-49-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-53-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2936-51-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3000-44-0x00000000005F0000-0x0000000000692000-memory.dmp

Filesize
648KB

Download
memory/3000-42-0x0000000000FA0000-0x0000000001032000-memory.dmp

Filesize
584KB

Download
memory/3000-43-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/3056-14-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-40-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-16-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-17-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-8-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3056-11-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-10-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-15-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-9-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-5-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-6-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download
memory/3056-7-0x0000000000C80000-0x0000000000D3C000-memory.dmp

Filesize
752KB

Download