lokibot | b58346f0463f45e1ecbd2a7bc9b8f51bfd519dcb06d7316475f13312de5209a4

General

Target
MV_Queen_DocS19180_B1.exe
Size 232KB
Sample220330-pbe99abhh3
SHA256 b58346f0463f45e1ecbd2a7bc9b8f51bfd519dcb06d7316475f13312de5209a4
MD5 3307cbc8954c28434ae40b9fcabb5fd8
SHA1 9915c4243ae85d6b4a02cb55402263d352d5e9c2
SHA512 26edcc71ae9e9cf2fff3ad296f4f0d92d357e0c454e7d2eee707d1c0630091f9255fc90b67a92ae36554df0705535a2ca04fab893e0611c2233f301b7538d9c8
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/ge10/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
2364	iahdnhplz.exe
2736	iahdnhplz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	iahdnhplz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	iahdnhplz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	iahdnhplz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 2736	2364	iahdnhplz.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	iahdnhplz.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2364	1676	MV_Queen_DocS19180_B1.exe	80
PID 1676 wrote to memory of 2364	1676	MV_Queen_DocS19180_B1.exe	80
PID 1676 wrote to memory of 2364	1676	MV_Queen_DocS19180_B1.exe	80
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81
PID 2364 wrote to memory of 2736	2364	iahdnhplz.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	iahdnhplz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	iahdnhplz.exe

C:\Users\Admin\AppData\Local\Temp\MV_Queen_DocS19180_B1.exe
"C:\Users\Admin\AppData\Local\Temp\MV_Queen_DocS19180_B1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe
  C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe C:\Users\Admin\AppData\Local\Temp\fgjbxc
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe
    C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe C:\Users\Admin\AppData\Local\Temp\fgjbxc
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9w2d8gx4qrry1n380jgd

Path C:\Users\Admin\AppData\Local\Temp\9w2d8gx4qrry1n380jgd
Size 212KB
SHA256 418af4ca31de2a4957edce0209e4d22f9a9af78c2b771ca1e1fc56fc98c4a046
MD5 4b06fba5a2224e1417ccccf2fd3980ad
SHA1 cc672098aca963c36a3669a0224b660742f0d4cc
SHA512 24f98792e975fe923909814ed521f454b68f1ca4dbab181a0382a14c0e8457de9924fd355d9945bf1c58ddcf9419ee8cf48ba2bdef7485b094c8f213df969775
MD5 SHA1 SHA512

Submit Download

fgjbxc

Path C:\Users\Admin\AppData\Local\Temp\fgjbxc
Size 4KB
SHA256 8e830ee731be72c5d16e3a25f894276db0f0f17a08ba5e0b56a89510639fff43
MD5 8e1f81fe786c64f3dd46cbbdbec22d5a
SHA1 18f864e1fa1dfe4997d5adb4ac7cdba962bd3d07
SHA512 2fe7a7cc54b93c5138d4de5b15ff99562e412af968504847d3cc252530f81cfd24ea635e38978573470cd63b41db2185f78a67a26579d590ad334ebc499d3b51
MD5 SHA1 SHA512

Submit Download

iahdnhplz.exe

Path C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe
Size 4KB
SHA256 db24d3d2f2ff8308d389117e4e6827e1d2a3b7b9448aab864d54b35ff45f1f23
MD5 3b89cc83750201240b2e485ccf884e8a
SHA1 eb2eaad5fec208d5679cf1043ce61d7080c45478
SHA512 9ceaf113c43ea8515351efd692140325517877afdcee29c15b22386538be12772c08f928c505f08eef4c870ecc88d60ba4a2f577a8002e5298c920bb2527b245
MD5 SHA1 SHA512

Submit Download

iahdnhplz.exe

Path C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe
Size 4KB
SHA256 db24d3d2f2ff8308d389117e4e6827e1d2a3b7b9448aab864d54b35ff45f1f23
MD5 3b89cc83750201240b2e485ccf884e8a
SHA1 eb2eaad5fec208d5679cf1043ce61d7080c45478
SHA512 9ceaf113c43ea8515351efd692140325517877afdcee29c15b22386538be12772c08f928c505f08eef4c870ecc88d60ba4a2f577a8002e5298c920bb2527b245
MD5 SHA1 SHA512

Submit Download

iahdnhplz.exe

Path C:\Users\Admin\AppData\Local\Temp\iahdnhplz.exe
Size 4KB
SHA256 db24d3d2f2ff8308d389117e4e6827e1d2a3b7b9448aab864d54b35ff45f1f23
MD5 3b89cc83750201240b2e485ccf884e8a
SHA1 eb2eaad5fec208d5679cf1043ce61d7080c45478
SHA512 9ceaf113c43ea8515351efd692140325517877afdcee29c15b22386538be12772c08f928c505f08eef4c870ecc88d60ba4a2f577a8002e5298c920bb2527b245
MD5 SHA1 SHA512

Submit Download

memory/2736-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2736-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads