lokibot | 2f232625bffd6132ba302fadcc7dca643d2b02a229fd09964d03b094b882ff47

General

Target
17472a868a083b5ce48451eb79777da0.exe
Size 231KB
Sample220405-xprt7sbgc4
SHA256 2f232625bffd6132ba302fadcc7dca643d2b02a229fd09964d03b094b882ff47
MD5 17472a868a083b5ce48451eb79777da0
SHA1 9df5ea1da229e1f187b827ba55de00245d43f514
SHA512 db728a82779b94a6996e5d78e32729d9fd44fd288ed024f27d40c2f4a403a1004f5ce2897d5c08b8731cfe84eb29c926298e02e9635f0497d2a8b2f8b724cd5c
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
4168	hohdcwd.exe
460	hohdcwd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	hohdcwd.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	hohdcwd.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	hohdcwd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 460	4168	hohdcwd.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	hohdcwd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 4168	3188	17472a868a083b5ce48451eb79777da0.exe	80
PID 3188 wrote to memory of 4168	3188	17472a868a083b5ce48451eb79777da0.exe	80
PID 3188 wrote to memory of 4168	3188	17472a868a083b5ce48451eb79777da0.exe	80
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81
PID 4168 wrote to memory of 460	4168	hohdcwd.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	hohdcwd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	hohdcwd.exe

C:\Users\Admin\AppData\Local\Temp\17472a868a083b5ce48451eb79777da0.exe
"C:\Users\Admin\AppData\Local\Temp\17472a868a083b5ce48451eb79777da0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe
  C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe C:\Users\Admin\AppData\Local\Temp\gmytpwdug
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe
    C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe C:\Users\Admin\AppData\Local\Temp\gmytpwdug
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eq4ts1uk5antik3

Path C:\Users\Admin\AppData\Local\Temp\eq4ts1uk5antik3
Size 211KB
SHA256 57747dc6c5b3390db01ea38f776eb96acc2af9ead01bbeb00567eb21cfeac503
MD5 7a2aa6cd59ad9b3f689e45e1e28b07cf
SHA1 29ece839d578382739bc375577af6bd742149c25
SHA512 1a64697795d3249d8b5887df0d4a2f965976b7020e9804c5e75acd1e6813a1ac9199ee8f994615411179ae522ef468235a218bdefd8553a0b899ca10e13dfdc2
SSDEEP 3072:xCs0VEAHRbn1jLRHMelNRlcpV4XqKS7GkvzNmQ+AA1OCcRmt2CIMBclVUPq:D0DnRLuelNRlc8XqK1cUPD1OdYZJcnkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmytpwdug

Path C:\Users\Admin\AppData\Local\Temp\gmytpwdug
Size 5KB
SHA256 9940a15f515e62490112c1b9513aafaa9ab6e000e8031ba3b6cc1124f606880a
MD5 2ee23350ef6b6805a60d5229ffd42a36
SHA1 56e5204fe265c1311a355d8b2b9ca707d54267ba
SHA512 7140496e93124a83823a4ae8ee8401f06fe30f2fd1818b401d48954cc108dae8812fd3049c787a7ed28f6658a12286a2e8f658c2d971439a4aef9b53f64c9c26
SSDEEP 96:ivnoX8VmEjR0qREdg1igE37MPexeItt+emT71idiYNLiyWRMNi8GorOSa:4oXW5uPg0g4px5ttvY71idiI3wX
MD5 SHA1 SHA512 SSDEEP

Submit Download

hohdcwd.exe

Path C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe
Size 4KB
SHA256 496cf0a6f8e4e7d2084a72052c64db61f9648f384edbc20556570496a4483d0d
MD5 033deb620a496960f3c89dd2db2632ef
SHA1 01c115f284ef5b9b4aba541a0ca16118a8077624
SHA512 2206ca24fe12cb590b69c4a75cbfd164bbfbdb5e8c726edc94dd3a883442ca2d6a518799fa0e37fa75015b7f10f2ffde38cfc347f51b02765ef2c5cafc04eb27
MD5 SHA1 SHA512

Submit Download

hohdcwd.exe

Path C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe
Size 4KB
SHA256 496cf0a6f8e4e7d2084a72052c64db61f9648f384edbc20556570496a4483d0d
MD5 033deb620a496960f3c89dd2db2632ef
SHA1 01c115f284ef5b9b4aba541a0ca16118a8077624
SHA512 2206ca24fe12cb590b69c4a75cbfd164bbfbdb5e8c726edc94dd3a883442ca2d6a518799fa0e37fa75015b7f10f2ffde38cfc347f51b02765ef2c5cafc04eb27
MD5 SHA1 SHA512

Submit Download

hohdcwd.exe

Path C:\Users\Admin\AppData\Local\Temp\hohdcwd.exe
Size 4KB
SHA256 496cf0a6f8e4e7d2084a72052c64db61f9648f384edbc20556570496a4483d0d
MD5 033deb620a496960f3c89dd2db2632ef
SHA1 01c115f284ef5b9b4aba541a0ca16118a8077624
SHA512 2206ca24fe12cb590b69c4a75cbfd164bbfbdb5e8c726edc94dd3a883442ca2d6a518799fa0e37fa75015b7f10f2ffde38cfc347f51b02765ef2c5cafc04eb27
MD5 SHA1 SHA512

Submit Download

memory/460-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/460-134-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4168-130-0x0000000000870000-0x0000000000872000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads