lokibot | 411582d4afb006f7eb33b73fc4bf7f4c94aaf18c79e2b0f073dbaa5a5b9426e1

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20220331-en
submitted
11/04/2022, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
608df417200ee30e78d01fbbae48cb37.exe
Size 230KB
Sample220411-jmh8dsfaa5
SHA256 411582d4afb006f7eb33b73fc4bf7f4c94aaf18c79e2b0f073dbaa5a5b9426e1
MD5 608df417200ee30e78d01fbbae48cb37
SHA1 8f0ea41be423978f113c5806374d265ee390c317
SHA512 b31abe47fe2ce1a8e39aa5b299a909fd476053a40322d2711779fc1435e61756747b72810ed839b930ff02b944f38377cc4951f005354d7440f6602a26799355
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1672	qcvdupa.exe
1052	qcvdupa.exe

Loads dropped DLL 2 IoCs

pid	Process
1636	608df417200ee30e78d01fbbae48cb37.exe
1672	qcvdupa.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qcvdupa.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	qcvdupa.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qcvdupa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1052	1672	qcvdupa.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	qcvdupa.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1672	1636	608df417200ee30e78d01fbbae48cb37.exe	28
PID 1636 wrote to memory of 1672	1636	608df417200ee30e78d01fbbae48cb37.exe	28
PID 1636 wrote to memory of 1672	1636	608df417200ee30e78d01fbbae48cb37.exe	28
PID 1636 wrote to memory of 1672	1636	608df417200ee30e78d01fbbae48cb37.exe	28
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29
PID 1672 wrote to memory of 1052	1672	qcvdupa.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qcvdupa.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qcvdupa.exe

C:\Users\Admin\AppData\Local\Temp\608df417200ee30e78d01fbbae48cb37.exe
"C:\Users\Admin\AppData\Local\Temp\608df417200ee30e78d01fbbae48cb37.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe
  C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe C:\Users\Admin\AppData\Local\Temp\pfcmvkc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe
    C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe C:\Users\Admin\AppData\Local\Temp\pfcmvkc
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0cohri3qec9mqm0ig

Path C:\Users\Admin\AppData\Local\Temp\0cohri3qec9mqm0ig
Size 209KB
SHA256 28ee326781473e7965b43455b8684b4dafefbd49df6782cb8104195be076deed
MD5 2f76f0897574db7da5f57fbdbe445c13
SHA1 399ed60fe57ea7ec0cc97ef428b2d3be443cfb73
SHA512 b832c0856b9cf9950098bf1297696e64ab775c22baac467f68288676fc4e27a2e7b5c89340c78b1bdb0e4a3ba9a120d6c51a78546f154270a1095b5390fd1bc1
SSDEEP 3072:YqyxezNQfPZXE1/veEVej9NQ+azbLdMeaSTE/D7s0a4sqDynRQ9cwZHR8zwPLbUi:Rkf6heEQjyn3TEHa4Y2TZxFD4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfcmvkc

Path C:\Users\Admin\AppData\Local\Temp\pfcmvkc
Size 4KB
SHA256 61c0a08cb19151c2c4b218c7953638d609e635fab2e449dc0793cf37c9510d5e
MD5 2d59192c47a71d67fa6e5a84f7edf642
SHA1 b80bd4e127c47feb007f0a21d448e7df32bad565
SHA512 57fa1001c692d4893fb9abf83c2a2af17f0080dbdcf2413ce5c3185295bfdab2df496f47779d0c6abf4daf06ec0743fb7d9e3d9f1968a1b11f23431ba61482ff
SSDEEP 96:g3HkG23ENinWtthEmFRySgmIRg1H0tdeQsbLaoQlqFi0UBy6VXysB9Iet:g0z04B+UtdY1Gy6VX1Blt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qcvdupa.exe

Path C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe
Size 5KB
SHA256 5a83fb28ffe6ba797ef15c59fda67354d042a160e9058a98ea1d76fe0b1bf381
MD5 f1172f1c5cc34a1a37557beb9f92c96d
SHA1 d8ddf06ba73c68124b738b2715488698dbdad53e
SHA512 64e8193335574ca46ae04a7a77699204d52c7a61f15f5e4efeea4d631a7ac91526c62eaa2f018e5a2f4a205dfb024fbaa6dfedf428f90f13d26d553a04cfb9a7
SSDEEP 48:ixe8wss5hzBGK2rbp2K1PChRZIZnliLBGjwIJRuqSB:3ss5FBBQbp2wLlwKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qcvdupa.exe

Path C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe
Size 5KB
SHA256 5a83fb28ffe6ba797ef15c59fda67354d042a160e9058a98ea1d76fe0b1bf381
MD5 f1172f1c5cc34a1a37557beb9f92c96d
SHA1 d8ddf06ba73c68124b738b2715488698dbdad53e
SHA512 64e8193335574ca46ae04a7a77699204d52c7a61f15f5e4efeea4d631a7ac91526c62eaa2f018e5a2f4a205dfb024fbaa6dfedf428f90f13d26d553a04cfb9a7
SSDEEP 48:ixe8wss5hzBGK2rbp2K1PChRZIZnliLBGjwIJRuqSB:3ss5FBBQbp2wLlwKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qcvdupa.exe

Path C:\Users\Admin\AppData\Local\Temp\qcvdupa.exe
Size 5KB
SHA256 5a83fb28ffe6ba797ef15c59fda67354d042a160e9058a98ea1d76fe0b1bf381
MD5 f1172f1c5cc34a1a37557beb9f92c96d
SHA1 d8ddf06ba73c68124b738b2715488698dbdad53e
SHA512 64e8193335574ca46ae04a7a77699204d52c7a61f15f5e4efeea4d631a7ac91526c62eaa2f018e5a2f4a205dfb024fbaa6dfedf428f90f13d26d553a04cfb9a7
SSDEEP 48:ixe8wss5hzBGK2rbp2K1PChRZIZnliLBGjwIJRuqSB:3ss5FBBQbp2wLlwKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qcvdupa.exe

Path \Users\Admin\AppData\Local\Temp\qcvdupa.exe
Size 5KB
SHA256 5a83fb28ffe6ba797ef15c59fda67354d042a160e9058a98ea1d76fe0b1bf381
MD5 f1172f1c5cc34a1a37557beb9f92c96d
SHA1 d8ddf06ba73c68124b738b2715488698dbdad53e
SHA512 64e8193335574ca46ae04a7a77699204d52c7a61f15f5e4efeea4d631a7ac91526c62eaa2f018e5a2f4a205dfb024fbaa6dfedf428f90f13d26d553a04cfb9a7
SSDEEP 48:ixe8wss5hzBGK2rbp2K1PChRZIZnliLBGjwIJRuqSB:3ss5FBBQbp2wLlwKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qcvdupa.exe

Path \Users\Admin\AppData\Local\Temp\qcvdupa.exe
Size 5KB
SHA256 5a83fb28ffe6ba797ef15c59fda67354d042a160e9058a98ea1d76fe0b1bf381
MD5 f1172f1c5cc34a1a37557beb9f92c96d
SHA1 d8ddf06ba73c68124b738b2715488698dbdad53e
SHA512 64e8193335574ca46ae04a7a77699204d52c7a61f15f5e4efeea4d631a7ac91526c62eaa2f018e5a2f4a205dfb024fbaa6dfedf428f90f13d26d553a04cfb9a7
SSDEEP 48:ixe8wss5hzBGK2rbp2K1PChRZIZnliLBGjwIJRuqSB:3ss5FBBQbp2wLlwKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1052-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1636-54-0x0000000076191000-0x0000000076193000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads