lokibot | 959d7b321afae31ebf810ede4fe1b19d5289128cf2255809ea9c30a71fb92fae

Analysis

max time kernel
136s
max time network
148s
platform
windows7_x64
resource
win7-20220331-en
submitted
11/04/2022, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28a17ccdd94d1898394d70dbd557ec70.exe
Size 233KB
Sample220411-jmh8dsfaa4
SHA256 959d7b321afae31ebf810ede4fe1b19d5289128cf2255809ea9c30a71fb92fae
MD5 28a17ccdd94d1898394d70dbd557ec70
SHA1 a2f996162fa6829b577ef6254660e34050ac595c
SHA512 becc8e93f71fd091daf4bd28be3568fc85575a7a355a369135c30777a709a350b7f75013dca08026138d52b62ca1df06265b87aa4f9ab478e74537743fbc201a
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1748	jeuwmbyzrh.exe
1708	jeuwmbyzrh.exe

Loads dropped DLL 2 IoCs

pid	Process
452	28a17ccdd94d1898394d70dbd557ec70.exe
1748	jeuwmbyzrh.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jeuwmbyzrh.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	jeuwmbyzrh.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jeuwmbyzrh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 1708	1748	jeuwmbyzrh.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	jeuwmbyzrh.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1748	452	28a17ccdd94d1898394d70dbd557ec70.exe	28
PID 452 wrote to memory of 1748	452	28a17ccdd94d1898394d70dbd557ec70.exe	28
PID 452 wrote to memory of 1748	452	28a17ccdd94d1898394d70dbd557ec70.exe	28
PID 452 wrote to memory of 1748	452	28a17ccdd94d1898394d70dbd557ec70.exe	28
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29
PID 1748 wrote to memory of 1708	1748	jeuwmbyzrh.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	jeuwmbyzrh.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jeuwmbyzrh.exe

C:\Users\Admin\AppData\Local\Temp\28a17ccdd94d1898394d70dbd557ec70.exe
"C:\Users\Admin\AppData\Local\Temp\28a17ccdd94d1898394d70dbd557ec70.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
  C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
    C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dnrmyqclc

Path C:\Users\Admin\AppData\Local\Temp\dnrmyqclc
Size 5KB
SHA256 dcfd8a084f245354d7802b215f2d9861d19068d9ad3d985c9d9188cf812cabf7
MD5 1c77c785fb7e151bb2787e3cbbc48385
SHA1 72d98cfd4afde39181cd023d2845747c60a60acb
SHA512 57c812f696c9b56e6d539ba77a9b1014aabb4185138dd9fab42ff0abd4f5a626548eb186782c3b40d236d5e2f1358fe40f925c8b4603e1d7c1c8bff5b63a9eab
SSDEEP 96:kKECFtCQGEc2PfPi7+zVvxlyQTVZNNpEykZAfZCnmWkPdZ2LnPbbbdVkAL3hzrqV:uwpfPiSzA6PNNpEysAfAnmWkPdZ2LnPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path C:\Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

udw54t7t6g

Path C:\Users\Admin\AppData\Local\Temp\udw54t7t6g
Size 212KB
SHA256 c06dd9f1b9fae1a86d99a3834eea47d243bc225cbe892d7ac3b396ac4a89d064
MD5 955b1321618c222dece27dc6465aa698
SHA1 f3746c3f05d279d6933c99f2780226c8953914e3
SHA512 198d470cd589c2acddff1b6d562af7badfc3115884bccc4c0a2594a060de70ecd92f9c89307a7f3c7394e43ac79bb5953d1d0d6c029ea590269cba6ebfe44e86
SSDEEP 3072:r3+LZbj0ev1R/h2K5sfFyiduJIUeuEhwAyBMJrTpbEVOHZzazK5Bp6h:roZbjnbhE88om3wAK4rltHdazIB4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path \Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeuwmbyzrh.exe

Path \Users\Admin\AppData\Local\Temp\jeuwmbyzrh.exe
Size 6KB
SHA256 c5b5ba02716a2f94e2a0ac623b349ef6b772829358ddff2fdcef6bdf35d83068
MD5 55f52e77d75758d27fa2a493e3273bbe
SHA1 1b48de7569a89c905eb1457375c184dca830582f
SHA512 6dfb4889d12499f7b5e43ac48cd41e7217eb94370d4c581fd2877b3c5a1a3be50316e3b2e0680910143dc971b59720360d5740f8ebe463e5a392a5bf26e3db45
SSDEEP 96:BmsGYiCBIv3ZW5D7/T17BLRjCX3jSVRy3Jo2:PViCKq/T19tjCX38k5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-54-0x0000000075131000-0x0000000075133000-memory.dmp

Download

memory/1708-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1708-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads