lokibot | 82109abba4efa2f377c8e51ce66906f69d8fd24edad89de97eef90abd61ee1d0

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT-CopyChip1ExchangeGmbHCo.KG.exe
Size 1.2MB
Sample241104-kfc88sxfph
SHA256 82109abba4efa2f377c8e51ce66906f69d8fd24edad89de97eef90abd61ee1d0
MD5 2d2c8245a02502abe493532525cebeb4
SHA1 4bfc152b6842d1c7637b0170f1aa8d39576420d1
SHA512 fd7f8278776bd2d5e8f9e37c86a70341a72f1a72cbe1769170d5557602f722857cabc67776c00767e8d2451b699c28ce8542cd64441ac5a0155dc52bea9f5bbc
SSDEEP 24576:YAHnh+eWsN3skA4RV1Hom2KXFmIap9tlBnOJ19voyL85:fh+ZkldoPK1Xap/jnOh2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://94.156.177.220/ty/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3460 set thread context of 4828	3460	TT-CopyChip1ExchangeGmbHCo.KG.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT-CopyChip1ExchangeGmbHCo.KG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT-CopyChip1ExchangeGmbHCo.KG.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4232	TT-CopyChip1ExchangeGmbHCo.KG.exe
3460	TT-CopyChip1ExchangeGmbHCo.KG.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1272	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	87
PID 4232 wrote to memory of 1272	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	87
PID 4232 wrote to memory of 1272	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	87
PID 4232 wrote to memory of 3460	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	88
PID 4232 wrote to memory of 3460	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	88
PID 4232 wrote to memory of 3460	4232	TT-CopyChip1ExchangeGmbHCo.KG.exe	88
PID 3460 wrote to memory of 4828	3460	TT-CopyChip1ExchangeGmbHCo.KG.exe	89
PID 3460 wrote to memory of 4828	3460	TT-CopyChip1ExchangeGmbHCo.KG.exe	89
PID 3460 wrote to memory of 4828	3460	TT-CopyChip1ExchangeGmbHCo.KG.exe	89
PID 3460 wrote to memory of 4828	3460	TT-CopyChip1ExchangeGmbHCo.KG.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	svchost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe
"C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe
  "C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\TT-CopyChip1ExchangeGmbHCo.KG.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Esher

Path C:\Users\Admin\AppData\Local\Temp\Esher
Size 104KB
SHA256 9416d95289c3e791f34ae92dc73ff75728285f42b35ff1ca8a8c5c84dec02259
MD5 6667c3c5f58be52d84958a47183b0d82
SHA1 13df7b984ce783b559366fa1106a2ab201da02aa
SHA512 e844b491b52ffe203abd90fddf451234f29920cb1fc3fd0c44b713270afc746693571fbd5522b90a5c9af31040a151d6bd8341075cfbaf38781bd9d68f4786b6
SSDEEP 3072:hsxTLCV+lAgt82jhmZuWx1AY/vSzrmEUk/pRQ:hswV+lAgrYZdA4vSzrmEtRQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bothsidedness

Path C:\Users\Admin\AppData\Local\Temp\bothsidedness
Size 140KB
SHA256 aff29f92fa12c8de22b314d3ae70b21d46afb386ab38a9d671a839dd1100a55a
MD5 0562fd5c203482cca22501025d4d1be0
SHA1 bf3f0d002c86f468eecede94b1f5fac65766b649
SHA512 17171a98569ec9e0bee3ceb290ed656579aa5e56c3d64b310e3fcb6b4bc55971d5ba6d49ddef46c57535cf38c37eb891a322aea004b3db0a5745c9953dd697fb
SSDEEP 192:en/SvruY9XdqOWTConmo9/W+WW5xoUfoN/WtqWmPzNW/YKM2nRSn1Dq/M1WShL1C:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

memory/3460-25-0x0000000001730000-0x0000000001B30000-memory.dmp

Download

memory/3460-52-0x0000000001730000-0x0000000001B30000-memory.dmp

Download

memory/4232-11-0x0000000000DD0000-0x00000000011D0000-memory.dmp

Download

memory/4828-26-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4828-28-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4828-29-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4828-50-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4828-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads