lokibot | a08a8aaa67f65ebe4ad2b3af52de80f9bdb4d05f7114e2d323af5f40386e984a

General

Target
348f3fa85be26eaf45471ac2b6f28f5a.exe
Size 233KB
Sample220401-rtj29scgd9
SHA256 a08a8aaa67f65ebe4ad2b3af52de80f9bdb4d05f7114e2d323af5f40386e984a
MD5 348f3fa85be26eaf45471ac2b6f28f5a
SHA1 1154263e760ef93a81c9eb8013de170e8cbd4ae7
SHA512 a8b72d1d45917b4a44a9bad309da216a54c2abed64c8ee205ced056ca556ead341186339aff3a346dc8f6acd3df25c930ea55fa2506594bf281d4f12207cd119
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://plxnva67001gs6gljacjpqudhatjqf.tk/Exodus1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1292	nndiseh.exe
2776	nndiseh.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nndiseh.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	nndiseh.exe
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nndiseh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 2776	1292	nndiseh.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	nndiseh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1292	4320	348f3fa85be26eaf45471ac2b6f28f5a.exe	76
PID 4320 wrote to memory of 1292	4320	348f3fa85be26eaf45471ac2b6f28f5a.exe	76
PID 4320 wrote to memory of 1292	4320	348f3fa85be26eaf45471ac2b6f28f5a.exe	76
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77
PID 1292 wrote to memory of 2776	1292	nndiseh.exe	77

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nndiseh.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nndiseh.exe

C:\Users\Admin\AppData\Local\Temp\348f3fa85be26eaf45471ac2b6f28f5a.exe
"C:\Users\Admin\AppData\Local\Temp\348f3fa85be26eaf45471ac2b6f28f5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\nndiseh.exe
  C:\Users\Admin\AppData\Local\Temp\nndiseh.exe C:\Users\Admin\AppData\Local\Temp\ivtwijtul
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\nndiseh.exe
    C:\Users\Admin\AppData\Local\Temp\nndiseh.exe C:\Users\Admin\AppData\Local\Temp\ivtwijtul
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgkldoeh46hasovq

Path C:\Users\Admin\AppData\Local\Temp\dgkldoeh46hasovq
Size 213KB
SHA256 8b7378d1872b68d73857e4e4f19f678a036eda24877c086a32e82ebf79365b49
MD5 ca3971d1cba347bfadd5fe149138e29d
SHA1 dc0fedefbd03d4d783626cffddc980ec8b19c578
SHA512 b7728e8c8763aab5e9b9b314da3cba30e04e9781bb6b0febfee25cc6bfa68112c3ab73e5ef92c0337f38757fd0ed5ccd08e7dc302924a3a38da817daee0d8da2
SSDEEP 6144:ZOH0SjY/kKj2trdx5/dH8lNNltgq0qpq2dR7cW:ZOZY/kKjglH8bNlCHqpqARd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ivtwijtul

Path C:\Users\Admin\AppData\Local\Temp\ivtwijtul
Size 5KB
SHA256 490b260d8532af55b89b0c81e9fb3b0aa781978b38f39ee3ff479b4b2c35d929
MD5 07e2de959d1c6051629feeb472d3e7b6
SHA1 5c1b283ac7815891560fac80ad21e6831f64971c
SHA512 befb78369fd2e54ee535da97d1e76956608ded7ed53a07732eaaa1656dbc7d42d6191a599851b5189d31fe38fe28c8779b877c4e8ab7b4ab1848192419d37550
SSDEEP 96:ffVETRicZBsuiNxDCQgFZ0M/+QgrOtwWslKV3ILmoBEz7mw0n8749qO:ffVETRicXsvWQv9Qdt1IKBIafLa9qO
MD5 SHA1 SHA512 SSDEEP

Submit Download

nndiseh.exe

Path C:\Users\Admin\AppData\Local\Temp\nndiseh.exe
Size 4KB
SHA256 08e5a67d3ae8c86c84f52d1588eaaada95dfcd60c26c581534ba390aef9007ef
MD5 ccc6e7449516551989483a6757f414c1
SHA1 5444df7ebc0458171152c5832e683f23f462e618
SHA512 9bf8b721c9f47d06777345ef2a26e7d4d6bc5f440035fdcfa41c35a05c520ac1b6a2e8f2177935e21510499670f176b0a066cd241822c8b9f32f4407ca5b7691
SSDEEP 48:vpgaa7Ao0iS7pFoUvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR6SMy:Bpp7vrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

nndiseh.exe

Path C:\Users\Admin\AppData\Local\Temp\nndiseh.exe
Size 4KB
SHA256 08e5a67d3ae8c86c84f52d1588eaaada95dfcd60c26c581534ba390aef9007ef
MD5 ccc6e7449516551989483a6757f414c1
SHA1 5444df7ebc0458171152c5832e683f23f462e618
SHA512 9bf8b721c9f47d06777345ef2a26e7d4d6bc5f440035fdcfa41c35a05c520ac1b6a2e8f2177935e21510499670f176b0a066cd241822c8b9f32f4407ca5b7691
SSDEEP 48:vpgaa7Ao0iS7pFoUvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR6SMy:Bpp7vrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

nndiseh.exe

Path C:\Users\Admin\AppData\Local\Temp\nndiseh.exe
Size 4KB
SHA256 08e5a67d3ae8c86c84f52d1588eaaada95dfcd60c26c581534ba390aef9007ef
MD5 ccc6e7449516551989483a6757f414c1
SHA1 5444df7ebc0458171152c5832e683f23f462e618
SHA512 9bf8b721c9f47d06777345ef2a26e7d4d6bc5f440035fdcfa41c35a05c520ac1b6a2e8f2177935e21510499670f176b0a066cd241822c8b9f32f4407ca5b7691
SSDEEP 48:vpgaa7Ao0iS7pFoUvn73HBGM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmR6SMy:Bpp7vrAMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2776-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2776-133-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads