lokibot | da2ad193ca616a908d2f7b3d9a68a76983c812e4b98f3df0bf6a8c096e93a8e1

General

Target
b56daa79ce1d21efee3f6481572fae90.exe
Size 240KB
Sample220329-kr54dsche3
SHA256 da2ad193ca616a908d2f7b3d9a68a76983c812e4b98f3df0bf6a8c096e93a8e1
MD5 b56daa79ce1d21efee3f6481572fae90
SHA1 501dd7c7ceda1453deeac10d53c8b83d49d2c9bd
SHA512 d11691b4de151d541b4b533fae0f0c7f1bb1dfb1ebe349e2ac93819e0572d70c39c03a171ca2cb48122d804653f28f42b88d84525adf578ce36d05daf6d013c9
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://outlook-webpage-auth.ml/worldwide/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
3596	fqske.exe
4244	fqske.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	fqske.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fqske.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fqske.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 4244	3596	fqske.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	fqske.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3596	3728	b56daa79ce1d21efee3f6481572fae90.exe	79
PID 3728 wrote to memory of 3596	3728	b56daa79ce1d21efee3f6481572fae90.exe	79
PID 3728 wrote to memory of 3596	3728	b56daa79ce1d21efee3f6481572fae90.exe	79
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80
PID 3596 wrote to memory of 4244	3596	fqske.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fqske.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fqske.exe

C:\Users\Admin\AppData\Local\Temp\b56daa79ce1d21efee3f6481572fae90.exe
"C:\Users\Admin\AppData\Local\Temp\b56daa79ce1d21efee3f6481572fae90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\fqske.exe
  C:\Users\Admin\AppData\Local\Temp\fqske.exe C:\Users\Admin\AppData\Local\Temp\brrbvqpmlx
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\fqske.exe
    C:\Users\Admin\AppData\Local\Temp\fqske.exe C:\Users\Admin\AppData\Local\Temp\brrbvqpmlx
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2j8fy7l0svcdcmp

Path C:\Users\Admin\AppData\Local\Temp\2j8fy7l0svcdcmp
Size 210KB
SHA256 83568069c09c62bc52405e3dca6678aece179dcbdc9712c70757647a36f4018b
MD5 70e4a4570dae4a0a0f45f1be97c2bb37
SHA1 35e1e3bf822f800e90df0504bfe2a0a529fe9b43
SHA512 6ba090018f35471ebe18d1df9106b45d80748ae445bfd293aeafe05d24d7d183f56f4a8b42a51713cf3fc05c5deedb58ace64ff11a38c59743b73141d97f9735
MD5 SHA1 SHA512

Submit Download

brrbvqpmlx

Path C:\Users\Admin\AppData\Local\Temp\brrbvqpmlx
Size 4KB
SHA256 6408cba3f1670a6051054a7e30d37434e30c3f889fbf0c8f71990364e86a0070
MD5 c0e71f083afa67a623f3aacf957f7fb5
SHA1 9d332978723afe599680ea23fe0f9f17643450e7
SHA512 37c4e050f55e683de524c1ff3c59723dd962ad9b5cdd5ad9fb2562d8022a53570a2aaf008ef9ccda15c22299f85ec3b994ab5dace74f84ca2db1b18cadc6d009
MD5 SHA1 SHA512

Submit Download

fqske.exe

Path C:\Users\Admin\AppData\Local\Temp\fqske.exe
Size 3KB
SHA256 39b82e07b3e18a3ea28bf00d99ae5f917fd3bb37c0ec8d51c3d557e35c630479
MD5 10b3e54208de3cd580d08a7f92c4fb26
SHA1 15525e6d0b94b211acb6e43b3371b94d79d8e479
SHA512 19809731988af0fac35250c510283cc5b8a3877b59f65a1ddccc85bd6c0d922eebb5288fd75a15c9c553ab134ff1f826ff0e9c9ed27fd727c09e10d20f035330
MD5 SHA1 SHA512

Submit Download

fqske.exe

Path C:\Users\Admin\AppData\Local\Temp\fqske.exe
Size 3KB
SHA256 39b82e07b3e18a3ea28bf00d99ae5f917fd3bb37c0ec8d51c3d557e35c630479
MD5 10b3e54208de3cd580d08a7f92c4fb26
SHA1 15525e6d0b94b211acb6e43b3371b94d79d8e479
SHA512 19809731988af0fac35250c510283cc5b8a3877b59f65a1ddccc85bd6c0d922eebb5288fd75a15c9c553ab134ff1f826ff0e9c9ed27fd727c09e10d20f035330
MD5 SHA1 SHA512

Submit Download

fqske.exe

Path C:\Users\Admin\AppData\Local\Temp\fqske.exe
Size 3KB
SHA256 39b82e07b3e18a3ea28bf00d99ae5f917fd3bb37c0ec8d51c3d557e35c630479
MD5 10b3e54208de3cd580d08a7f92c4fb26
SHA1 15525e6d0b94b211acb6e43b3371b94d79d8e479
SHA512 19809731988af0fac35250c510283cc5b8a3877b59f65a1ddccc85bd6c0d922eebb5288fd75a15c9c553ab134ff1f826ff0e9c9ed27fd727c09e10d20f035330
MD5 SHA1 SHA512

Submit Download

memory/4244-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4244-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads