lokibot | 43c7f5fc7cfab29fae6e20f34e252bafc625d1498864cccf0450a2bb279f1df4

General

Target
1ecdbcad8db898790240781177dd8884.exe
Size 229KB
Sample220412-pwr5jsefa4
SHA256 43c7f5fc7cfab29fae6e20f34e252bafc625d1498864cccf0450a2bb279f1df4
MD5 1ecdbcad8db898790240781177dd8884
SHA1 f0f7c5dd7f63e8d6418b8f65d66e2b427ab1749d
SHA512 6941443c1353fceb377e9e68dc2edc7580c060be62e02b1e9a663f63c187bb7ea43e8059063675828747d50fd679d561c26cd4d161e6fa7b9e4ee3987049d7c9
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/userbob/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1136	twtbe.exe
2456	twtbe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	twtbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	twtbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	twtbe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 2456	1136	twtbe.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1136	2176	1ecdbcad8db898790240781177dd8884.exe	82
PID 2176 wrote to memory of 1136	2176	1ecdbcad8db898790240781177dd8884.exe	82
PID 2176 wrote to memory of 1136	2176	1ecdbcad8db898790240781177dd8884.exe	82
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83
PID 1136 wrote to memory of 2456	1136	twtbe.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	twtbe.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	twtbe.exe

C:\Users\Admin\AppData\Local\Temp\1ecdbcad8db898790240781177dd8884.exe
"C:\Users\Admin\AppData\Local\Temp\1ecdbcad8db898790240781177dd8884.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\twtbe.exe
  C:\Users\Admin\AppData\Local\Temp\twtbe.exe C:\Users\Admin\AppData\Local\Temp\qzxqrw
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Users\Admin\AppData\Local\Temp\twtbe.exe
    C:\Users\Admin\AppData\Local\Temp\twtbe.exe C:\Users\Admin\AppData\Local\Temp\qzxqrw
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:2456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95bq996lyy2cri7vby4l

Path C:\Users\Admin\AppData\Local\Temp\95bq996lyy2cri7vby4l
Size 212KB
SHA256 bb852ee9c6d7a1afd2c54cc646424a75f89c6a4738426229397f3ae6d55e7aad
MD5 8628363628481427ef96e613756e5f0f
SHA1 8338b962881d863627ea2d2c7d018c16b4639b44
SHA512 81f707d60a4724cea312258ef02810d8a7e397cbebd3531b12feb0b0e5e309ea888de4da5c5e7b8a78e2741e5dd5e3a704add9392c0d90ab3b17b8ba896cbfdc
SSDEEP 6144:0OEwNO3wcZGmKpYlf9cIPI/u3q68bIrGCJP1B:0OEcO3N6Olf9c//9CJ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzxqrw

Path C:\Users\Admin\AppData\Local\Temp\qzxqrw
Size 4KB
SHA256 a3c34f19343cb75b0365f42cdc7336488772272b07615aca66a930d10ca38398
MD5 5a552bbe5df32c6d867ed6241d8d29cd
SHA1 86b3ff9fc0e1c36ccf39a7a3dea45ce20fd126f9
SHA512 a0a6058797e32f967fbcb54912bb4a32edd646d2411586920f45bd959c791e718e2db9670a0044f3c1dff457e06b886e6c1ea7f752dad71206938bab47a173c9
SSDEEP 96:6iHmIe5l/jjqzfFSVUGHGsNTUkO7/719n43lAGnknyQX3hSuYRr:6i/il1Fbs/7H43lVH4rCr
MD5 SHA1 SHA512 SSDEEP

Submit Download

twtbe.exe

Path C:\Users\Admin\AppData\Local\Temp\twtbe.exe
Size 5KB
SHA256 c52060bf825333b9d305c97ccbadbfe807995136ab083c3641d4dad8b7d3c12a
MD5 4154db83c1fdb9f9033484b12af16362
SHA1 2c18968278d423d1f5ccd20a76cf695d72749a93
SHA512 606389a2c1b0ffaf74e807abd7493e5b6740accba2115730483d7ce359c577c97a2c06b8a9b0d7699f5909c24ba0a3630dace1a186f713419c5b5d30de90bba4
SSDEEP 48:ie71Vss5hzBGK2rbVJHlGXfLdYPPhqgT3uqMlGpy25HTcdpm/+oSBmniRuqSo:Vss5FBBQbVvGXGP3CGpyGIxBBmyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

twtbe.exe

Path C:\Users\Admin\AppData\Local\Temp\twtbe.exe
Size 5KB
SHA256 c52060bf825333b9d305c97ccbadbfe807995136ab083c3641d4dad8b7d3c12a
MD5 4154db83c1fdb9f9033484b12af16362
SHA1 2c18968278d423d1f5ccd20a76cf695d72749a93
SHA512 606389a2c1b0ffaf74e807abd7493e5b6740accba2115730483d7ce359c577c97a2c06b8a9b0d7699f5909c24ba0a3630dace1a186f713419c5b5d30de90bba4
SSDEEP 48:ie71Vss5hzBGK2rbVJHlGXfLdYPPhqgT3uqMlGpy25HTcdpm/+oSBmniRuqSo:Vss5FBBQbVvGXGP3CGpyGIxBBmyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

twtbe.exe

Path C:\Users\Admin\AppData\Local\Temp\twtbe.exe
Size 5KB
SHA256 c52060bf825333b9d305c97ccbadbfe807995136ab083c3641d4dad8b7d3c12a
MD5 4154db83c1fdb9f9033484b12af16362
SHA1 2c18968278d423d1f5ccd20a76cf695d72749a93
SHA512 606389a2c1b0ffaf74e807abd7493e5b6740accba2115730483d7ce359c577c97a2c06b8a9b0d7699f5909c24ba0a3630dace1a186f713419c5b5d30de90bba4
SSDEEP 48:ie71Vss5hzBGK2rbVJHlGXfLdYPPhqgT3uqMlGpy25HTcdpm/+oSBmniRuqSo:Vss5FBBQbVvGXGP3CGpyGIxBBmyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2456-130-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2456-133-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads