lokibot | 9abe3315fb8ffdaf1128f984194add626d0da9b68a0bfdd0d9dc7419634a5555

General

Target
31abc77d7c8402e457fd94ea0f43f82f.exe
Size 232KB
Sample220401-rszfkacgc8
SHA256 9abe3315fb8ffdaf1128f984194add626d0da9b68a0bfdd0d9dc7419634a5555
MD5 31abc77d7c8402e457fd94ea0f43f82f
SHA1 835ffee0037659eb82dc2c1aba147aa80ae7db98
SHA512 2e2e96386f27b8a95fd8fffee8dbe2025032a086bb1de281020721afa2fec2f5c0461e092a6bc59536b717e6cf3bc9683924ba95a8e644e6e3d444b2fc9dfb99
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
3936	gpnjkpijd.exe
1468	gpnjkpijd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gpnjkpijd.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	gpnjkpijd.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gpnjkpijd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 1468	3936	gpnjkpijd.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	gpnjkpijd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3936	1808	31abc77d7c8402e457fd94ea0f43f82f.exe	76
PID 1808 wrote to memory of 3936	1808	31abc77d7c8402e457fd94ea0f43f82f.exe	76
PID 1808 wrote to memory of 3936	1808	31abc77d7c8402e457fd94ea0f43f82f.exe	76
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77
PID 3936 wrote to memory of 1468	3936	gpnjkpijd.exe	77

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gpnjkpijd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gpnjkpijd.exe

C:\Users\Admin\AppData\Local\Temp\31abc77d7c8402e457fd94ea0f43f82f.exe
"C:\Users\Admin\AppData\Local\Temp\31abc77d7c8402e457fd94ea0f43f82f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe
  C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe C:\Users\Admin\AppData\Local\Temp\zibifibe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe
    C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe C:\Users\Admin\AppData\Local\Temp\zibifibe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gpnjkpijd.exe

Path C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe
Size 5KB
SHA256 402b95a711e85c93bc4950964f74a9654f41c0e97661a16d163457e4fcdeda35
MD5 366c60cb97351876828993ba7017d84b
SHA1 d8a1e6984a5e83ebdf7bacd0f7db8cbb46e25844
SHA512 7d4f4850c592f24f033754ab6971f30ff4af328e4cda25179dae9961db2918bc02031e0df5236fc19015ba2dc3ba555a9bc1320dc66b7eb9deac50678121453a
SSDEEP 48:vpgP7AOie45hJccnhQvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR8SMy:BBh5hWrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpnjkpijd.exe

Path C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe
Size 5KB
SHA256 402b95a711e85c93bc4950964f74a9654f41c0e97661a16d163457e4fcdeda35
MD5 366c60cb97351876828993ba7017d84b
SHA1 d8a1e6984a5e83ebdf7bacd0f7db8cbb46e25844
SHA512 7d4f4850c592f24f033754ab6971f30ff4af328e4cda25179dae9961db2918bc02031e0df5236fc19015ba2dc3ba555a9bc1320dc66b7eb9deac50678121453a
SSDEEP 48:vpgP7AOie45hJccnhQvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR8SMy:BBh5hWrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpnjkpijd.exe

Path C:\Users\Admin\AppData\Local\Temp\gpnjkpijd.exe
Size 5KB
SHA256 402b95a711e85c93bc4950964f74a9654f41c0e97661a16d163457e4fcdeda35
MD5 366c60cb97351876828993ba7017d84b
SHA1 d8a1e6984a5e83ebdf7bacd0f7db8cbb46e25844
SHA512 7d4f4850c592f24f033754ab6971f30ff4af328e4cda25179dae9961db2918bc02031e0df5236fc19015ba2dc3ba555a9bc1320dc66b7eb9deac50678121453a
SSDEEP 48:vpgP7AOie45hJccnhQvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR8SMy:BBh5hWrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

jugxoxjt3zd6bax3lhck

Path C:\Users\Admin\AppData\Local\Temp\jugxoxjt3zd6bax3lhck
Size 212KB
SHA256 adefdaa8419e13bb16144e8863ea110c5a3ede481fe8e0828e5639fb99922223
MD5 a1a3a8ca3c873a3669ef6bb558b7446d
SHA1 59f019adadbbca971984a28d48a2e223d5018d8d
SHA512 bdb8223215169c1bb10c5226cbe6a379012a54cdc2a90f768a3f088062a3594f736b7f0f4d40c54a9830549cce786d238e872910c321d4af46c14d5b52d40d6c
SSDEEP 6144:WD5rOVls9pNo0ZyBF9cHQmuhw3ogdZxEK0NHz:WD5rOnBF9cHQ5VgdZxEKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zibifibe

Path C:\Users\Admin\AppData\Local\Temp\zibifibe
Size 4KB
SHA256 e35c2c02e876ce2b6fc8b90a98459668daa7d415b92618a8f8a6256b5974d1e0
MD5 2bde054f4608dc15a414ceecb048c744
SHA1 4b63e7d26ed64fc132fc2ea620a283f06a84bbd8
SHA512 a63b980d6209395ccefa0bcb0154857a512c2f68b46d0527c40096b44e01a505163993c42b46bf5fda3fa6e4f51774e263bb04876ef7e00d42d785bf3b1ee445
SSDEEP 96:gkru3ohiirFJGownawzTtxlLPPWllNuLKomsjlv9t5SxiiodZNOV6l:gkyiRJpwawzJ/PP6lNuxBvL56g3M+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1468-133-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads