lokibot | 3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe
Size

733KB
MD5

c27bf6db51f64901ba56cf64003cabd2
SHA1

005e61ccfa9a0840d788bcff2a95cff7ec88d6db
SHA256

3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381
SHA512

1b3b19272c1d0ae7be07b4be04fbcc58e46b9fedeb31a4292bd3e8a270a2deee22efdd9891a26e708ac5d987b6996cefdac64665a685f52cbfcd54e66eb1d443
SSDEEP

12288:WcrNS33L10QdrX2mVnCGoe0cZKqMEF0JCEharfH0uceMTLlW44UdLZeZ:FNA3R5drXbVCGoRcZDMEwC9UucrjLc

Score

10^/10

lokibot collection discovery spyware stealer trojan

Malware Config

Extracted

Family

lokibot

https://www.stipamana.com/dftjedrshyyj/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot

Executes dropped EXE 5 IoCs

pid	Process
2740	segzs.sfx.exe
3040	segzs.exe
2064	segzs.exe
868	segzs.exe
2876	segzs.exe

Loads dropped DLL 8 IoCs

pid	Process
2736	cmd.exe
2740	segzs.sfx.exe
2740	segzs.sfx.exe
2740	segzs.sfx.exe
2740	segzs.sfx.exe
3040	segzs.exe
3040	segzs.exe
3040	segzs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	segzs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	segzs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	segzs.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 2064	3040	segzs.exe	35
PID 3040 set thread context of 868	3040	segzs.exe	36
PID 3040 set thread context of 2876	3040	segzs.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	segzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	segzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	segzs.sfx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	segzs.exe
Token: SeDebugPrivilege	2064	segzs.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2736	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	30
PID 3008 wrote to memory of 2736	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	30
PID 3008 wrote to memory of 2736	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	30
PID 3008 wrote to memory of 2736	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	30
PID 3008 wrote to memory of 2840	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	32
PID 3008 wrote to memory of 2840	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	32
PID 3008 wrote to memory of 2840	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	32
PID 3008 wrote to memory of 2840	3008	3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe	32
PID 2736 wrote to memory of 2740	2736	cmd.exe	33
PID 2736 wrote to memory of 2740	2736	cmd.exe	33
PID 2736 wrote to memory of 2740	2736	cmd.exe	33
PID 2736 wrote to memory of 2740	2736	cmd.exe	33
PID 2740 wrote to memory of 3040	2740	segzs.sfx.exe	34
PID 2740 wrote to memory of 3040	2740	segzs.sfx.exe	34
PID 2740 wrote to memory of 3040	2740	segzs.sfx.exe	34
PID 2740 wrote to memory of 3040	2740	segzs.sfx.exe	34
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 2064	3040	segzs.exe	35
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 868	3040	segzs.exe	36
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37
PID 3040 wrote to memory of 2876	3040	segzs.exe	37

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	segzs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	segzs.exe

C:\Users\Admin\AppData\Local\Temp\3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe
"C:\Users\Admin\AppData\Local\Temp\3439eaffe1dfd634b46a29ee7f0e938b5b05f9c784123a70b94f9f46aa370381.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\sfgdf.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Roaming\segzs.sfx.exe
    segzs.sfx.exe -pgeyhrntdeszopthnymkdetyuhngfszafupbodcsyRhvqxsdfHbgnmeL -dC:\Users\Admin\AppData\Roaming
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\Admin\AppData\Roaming\segzs.exe
      "C:\Users\Admin\AppData\Roaming\segzs.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\AppData\Roaming\segzs.exe
        
        C:\Users\Admin\AppData\Roaming\segzs.exe
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:2064
    - - C:\Users\Admin\AppData\Roaming\segzs.exe
        
        C:\Users\Admin\AppData\Roaming\segzs.exe
        5⤵
        Executes dropped EXE
        
        PID:868
    - - C:\Users\Admin\AppData\Roaming\segzs.exe
        
        C:\Users\Admin\AppData\Roaming\segzs.exe
        5⤵
        Executes dropped EXE
        
        PID:2876
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\mts103swift.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
44c5a9584c105cd22ca12ac9aa9b18f8

SHA1
39d48149dd8b67cfd76f342763d3a4f19a0fe046

SHA256
683e3219c2ab23ac92ef240ef8e609f37daa7168d909a61bb7fa994ed55eb4db

SHA512
9905aa5ec13a296afe96b37cc4366e81e3c9103158540729effb2c87a56307efd31f4466a9f4b8b113495de9cb7e267209fb939f5471a532240f01b2e0c49059

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4177215427-74451935-3209572229-1000\0f5007522459c86e95ffcc62f32308f1_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4177215427-74451935-3209572229-1000\0f5007522459c86e95ffcc62f32308f1_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\mts103swift.pdf

Filesize
43KB

MD5
f10334c1dc5e4aec8fffd10387397af2

SHA1
a520e2e581be33181af241dab80799813bda5785

SHA256
307dd5cbcabfcbfd86b65b45f70fb5fc349b861593b74f36ff6416dd5aa44d1e

SHA512
2da918d25e6c50ac2423951b161b9c84833e1d06a978043c7a2ca88952ee625e4a0d3886135d112c846159c80e4ab59862ed95e14d8de9dd3930c6232bd6aecc

Download Submit
C:\Users\Admin\AppData\Roaming\segzs.sfx.exe

Filesize
555KB

MD5
0be398a8808083c20b84daf04d18dee0

SHA1
718959fa4ec118470293016ffbc6f5afde595641

SHA256
967f6cf0fd1e698deb0cfedf0d017bd1d0c0240f7b8cb654467264d8a17c7e31

SHA512
4f42c66f6ea15cdaefad1f7d8daf528301dd3eaa4e5c6148c4d5dd7e2e9bc86817968bf692218c3f82c6bf49e496f48ba7e287419cd5add3e38f2d20eeaf8b8d

Download Submit
C:\Users\Admin\AppData\Roaming\sfgdf.bat

Filesize
18KB

MD5
9c3544830a2edeb178eb4082bf7875e0

SHA1
000eec764808b31eb32156ec23061060ec7747a6

SHA256
6c69d201f7e4eddf329fedf5184c8d8976ce89cc06442f2e6a225a79c7640516

SHA512
3a27c3ae65e4c49af8b43e9d7f0e6a2fcd92d29026306af50005163ff33bf44cd2640c3543c61bd44f7dbfd8d6d072f133a07aed5ce8b7a3bfbc501d8e233680

Download Submit
\Users\Admin\AppData\Roaming\segzs.exe

Filesize
319KB

MD5
e252eca9ccf8de2f046df3b51f6a5973

SHA1
0541e65f3018e3edf16832c111dc7a80c46d1b89

SHA256
a22ebfe0be1b8df037eac93cc45c3d65b1b12b1d3a889071e52779c4dcd9dceb

SHA512
1bf1785b1dee97e905c85f671c829b73eeba911763dc13bafe659ba8b02b8f812ea3cdaa66b59034d1f1d7e4e0011f0b43f9e252cd30372dbd9f1eb675360cdc

Download Submit
memory/2064-45-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2064-48-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2064-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3040-43-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/3040-42-0x0000000000BE0000-0x0000000000C3E000-memory.dmp

Filesize
376KB

Download
memory/3040-41-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3040-40-0x0000000000E70000-0x0000000000EC6000-memory.dmp

Filesize
344KB

Download