lokibot | 55631c19081f1770de475ae92b7d6c4a3ea3ee48b9528e9b787e959c9e9ea237

General

Target
IRQ2107798pdf.exe
Size 365KB
Sample220405-fsjvbshff7
SHA256 55631c19081f1770de475ae92b7d6c4a3ea3ee48b9528e9b787e959c9e9ea237
MD5 053c54292f48ceca522859f15f8f4895
SHA1 d8572a2f10d72780f1a1ff19c16043778bbcac41
SHA512 64bdb383b131b3ce285f3ed43972a044bbb290726a79f35e6be39f88f7232dc5069674802ea5d9f61b2ab7ed55b5b7303161fd21c6874d8c754f818ca1bcc47c
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://164.90.194.235/?id=58098847226041972
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
4304	bzrnkto.exe
3108	bzrnkto.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bzrnkto.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	bzrnkto.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bzrnkto.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 3108	4304	bzrnkto.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	bzrnkto.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4304	3184	IRQ2107798pdf.exe	80
PID 3184 wrote to memory of 4304	3184	IRQ2107798pdf.exe	80
PID 3184 wrote to memory of 4304	3184	IRQ2107798pdf.exe	80
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81
PID 4304 wrote to memory of 3108	4304	bzrnkto.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bzrnkto.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bzrnkto.exe

C:\Users\Admin\AppData\Local\Temp\IRQ2107798pdf.exe
"C:\Users\Admin\AppData\Local\Temp\IRQ2107798pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe
  C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe C:\Users\Admin\AppData\Local\Temp\qqwhtrhtv
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe
    C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe C:\Users\Admin\AppData\Local\Temp\qqwhtrhtv
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzrnkto.exe

Path C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe
Size 4KB
SHA256 a0a90f4e07de8db9378a82b29b2b53debc813f05e8d98f5571b7a202bcfc775a
MD5 13842fa95a14611187ae346389f2b533
SHA1 44b42d16cb7136151178c7492cf24c8c4ca03c5d
SHA512 5a62c5df9785c25c34518e70aed5cf64f03d3efe9587ef7529efe974ec42040ae27578625d0a9d0e68760d1754a3a81a91cf7131ce88b0939d42b0164147ab2d
SSDEEP 96:BhSuWzx0rPe070SAmYWr+MSiWEeqhJ604MYAq:H1WaB4xqQ/IH604MYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzrnkto.exe

Path C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe
Size 4KB
SHA256 a0a90f4e07de8db9378a82b29b2b53debc813f05e8d98f5571b7a202bcfc775a
MD5 13842fa95a14611187ae346389f2b533
SHA1 44b42d16cb7136151178c7492cf24c8c4ca03c5d
SHA512 5a62c5df9785c25c34518e70aed5cf64f03d3efe9587ef7529efe974ec42040ae27578625d0a9d0e68760d1754a3a81a91cf7131ce88b0939d42b0164147ab2d
SSDEEP 96:BhSuWzx0rPe070SAmYWr+MSiWEeqhJ604MYAq:H1WaB4xqQ/IH604MYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzrnkto.exe

Path C:\Users\Admin\AppData\Local\Temp\bzrnkto.exe
Size 4KB
SHA256 a0a90f4e07de8db9378a82b29b2b53debc813f05e8d98f5571b7a202bcfc775a
MD5 13842fa95a14611187ae346389f2b533
SHA1 44b42d16cb7136151178c7492cf24c8c4ca03c5d
SHA512 5a62c5df9785c25c34518e70aed5cf64f03d3efe9587ef7529efe974ec42040ae27578625d0a9d0e68760d1754a3a81a91cf7131ce88b0939d42b0164147ab2d
SSDEEP 96:BhSuWzx0rPe070SAmYWr+MSiWEeqhJ604MYAq:H1WaB4xqQ/IH604MYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eknfpm7ljbivg6m

Path C:\Users\Admin\AppData\Local\Temp\eknfpm7ljbivg6m
Size 210KB
SHA256 37046b945c0a7cc7861974a412483638076cd2013ee29c20bdd98f3088622710
MD5 9a8eeb993e7eef3755d636323ec1b4d6
SHA1 a98fdf92eaa4389615fb3753c5a369653106b9f2
SHA512 e6370f861a1158475bd0e4b014191013971837a339ee60ea879fd41c3c331187f93639fafd2f600c078422a359263f2716927dbfbc96fac7865eaa44c876a47e
SSDEEP 6144:hTx1WV7rTwmmdNemDpQ4PATdUTMjhRkLfpKt1JKjaJUm7a:hm9rf+Q4PATdURpEEj6Um+
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqwhtrhtv

Path C:\Users\Admin\AppData\Local\Temp\qqwhtrhtv
Size 5KB
SHA256 4922a233bcee21c43ea6966af288314e3b87671b4c11ff09bb8eb5abbb934578
MD5 6fa98b8047feb98a8477f0d98a05e153
SHA1 1972ddc688abacf271d54ce980519bdc6998ab7f
SHA512 49d89558d2c6a383153b84a8710de1300496da47eda128e30907231f58fa70e9c799b8c485994ebaa9af8eab3eab25f44d34ba2593bef50ff798b1423b19bc5b
SSDEEP 96:ZQIdJW5Cbb/pBIXuNGf3twCaTgWdU0e3+1tIcoGN1dPWqBXALSDxQu:Zy8PAKKtwCscOE8DPFXAex7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3108-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3108-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads