lokibot | ad924d27dc820f67d2253150531b4e2dd559d960697cd026ad5a4306d49f9aca

General

Target
Groupconfirmation.exe
Size 188KB
Sample221010-h6pc3sbbgp
SHA256 ad924d27dc820f67d2253150531b4e2dd559d960697cd026ad5a4306d49f9aca
MD5 f9ab4fefbda80e335429f78556bafdbd
SHA1 a54c2861b91f9256e28f6869b5ad430bab20eb19
SHA512 f1c62b74cb515bf5ad1fa7d5ea9ae4c9e19196fd470854d34bc45ce2badd5497119d57650996527efb69e7ac08b6887dcfb9b92a7d9ba44a10f2b32329fe8e6f
SSDEEP 3072:31NjcVVnLpPu32b/1kdHbXFFgTyiQamEYul9982ID9hyaD52OhOT/mMSnQo:lNeZtadHkG5CbCD97VsT/NUQo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
2012	myohii.exe

Loads dropped DLL 3 IoCs

pid	Process
1048	Groupconfirmation.exe
2012	myohii.exe
1784	myohii.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	myohii.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	myohii.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	myohii.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1784	2012	myohii.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	myohii.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2012	1048	Groupconfirmation.exe	27
PID 1048 wrote to memory of 2012	1048	Groupconfirmation.exe	27
PID 1048 wrote to memory of 2012	1048	Groupconfirmation.exe	27
PID 1048 wrote to memory of 2012	1048	Groupconfirmation.exe	27
PID 2012 wrote to memory of 1784	2012	myohii.exe	28
PID 2012 wrote to memory of 1784	2012	myohii.exe	28
PID 2012 wrote to memory of 1784	2012	myohii.exe	28
PID 2012 wrote to memory of 1784	2012	myohii.exe	28
PID 2012 wrote to memory of 1784	2012	myohii.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	myohii.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	myohii.exe

C:\Users\Admin\AppData\Local\Temp\Groupconfirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Groupconfirmation.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\myohii.exe
  "C:\Users\Admin\AppData\Local\Temp\myohii.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\myohii.exe
    "C:\Users\Admin\AppData\Local\Temp\myohii.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

myohii.exe

Path C:\Users\Admin\AppData\Local\Temp\myohii.exe
Size 123KB
SHA256 b81555762d4584988cfe55fe2cd9a6bc7cc231253d239877e0a0b406fc2e3fce
MD5 fa696b16f763f8820496eab98dff0733
SHA1 b04cca189b0561478f7cf2f393d1c9a2bbdf1eab
SHA512 83624c97582276f0d3efedaafee5b18730839fb100c1a18c84512ee34e45b4173e04f9c780b89411e89a6c3f81e24da78b8da04eb1aae0d99e304bc5f5864b99
SSDEEP 3072:/fWQ6ESTPnrfgIJKnuJitHEyRitb/zfdzSflJ:HWhEBkKnT2yRiIlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

myohii.exe

Path C:\Users\Admin\AppData\Local\Temp\myohii.exe
Size 123KB
SHA256 b81555762d4584988cfe55fe2cd9a6bc7cc231253d239877e0a0b406fc2e3fce
MD5 fa696b16f763f8820496eab98dff0733
SHA1 b04cca189b0561478f7cf2f393d1c9a2bbdf1eab
SHA512 83624c97582276f0d3efedaafee5b18730839fb100c1a18c84512ee34e45b4173e04f9c780b89411e89a6c3f81e24da78b8da04eb1aae0d99e304bc5f5864b99
SSDEEP 3072:/fWQ6ESTPnrfgIJKnuJitHEyRitb/zfdzSflJ:HWhEBkKnT2yRiIlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

myohii.exe

Path C:\Users\Admin\AppData\Local\Temp\myohii.exe
Size 123KB
SHA256 b81555762d4584988cfe55fe2cd9a6bc7cc231253d239877e0a0b406fc2e3fce
MD5 fa696b16f763f8820496eab98dff0733
SHA1 b04cca189b0561478f7cf2f393d1c9a2bbdf1eab
SHA512 83624c97582276f0d3efedaafee5b18730839fb100c1a18c84512ee34e45b4173e04f9c780b89411e89a6c3f81e24da78b8da04eb1aae0d99e304bc5f5864b99
SSDEEP 3072:/fWQ6ESTPnrfgIJKnuJitHEyRitb/zfdzSflJ:HWhEBkKnT2yRiIlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oncllzylztf.tt

Path C:\Users\Admin\AppData\Local\Temp\oncllzylztf.tt
Size 4KB
SHA256 5d9bc2585473c0b652be55d68a228831a9c8fd076506b8fc7d262b4da2929efb
MD5 77539b8cb4beeb2df26e975a99e30b0d
SHA1 7baa87f1ea61b306b9cfa8daf3fde17472be17a4
SHA512 a66f569ff508346c4d5a8541d72ba04ebbd81fa46ecc458bc5da1b81014134ecea6e4f00636c7df40cfc157e440910ab3c9508eeec393cfd197496035d1765fe
SSDEEP 96:emZR8FJ49czmcJxfC0atOmfQGs1jb25upP7ls5tgl1BNW6HZfvGU3iwNKqKtvdoc:nZR8HfzmcJI9smfQGsFb2547lsTgl1Bo
MD5 SHA1 SHA512 SSDEEP

Submit Download

zahcvsh.l

Path C:\Users\Admin\AppData\Local\Temp\zahcvsh.l
Size 104KB
SHA256 a28c3bf80a6345221ecdf64d1e970c4001a4ad45832103e70b468b8f8c1166ec
MD5 1f7d96c1ea41be038526b20792982c79
SHA1 7de1930cbd5462aedaa43566e3d07344854aaa18
SHA512 a1acedf27e9a8be94b6000e37609262a59cdaa92ea8bdfe5dce242a7297e2144d7c33660457e7922695d1e214e2bea4c191ae7d9816bbcefee6357d89d7b3bc4
SSDEEP 1536:ELm34ZIr4pUa0pMMWtDaXKc4qVzLDIf/2aNJqQfXYmouFR9Howt2NbQ9ZyKRSk2V:9fEj3XtDKQf/2cfCuZHo8hZyKIZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

myohii.exe

Path \Users\Admin\AppData\Local\Temp\myohii.exe
Size 123KB
SHA256 b81555762d4584988cfe55fe2cd9a6bc7cc231253d239877e0a0b406fc2e3fce
MD5 fa696b16f763f8820496eab98dff0733
SHA1 b04cca189b0561478f7cf2f393d1c9a2bbdf1eab
SHA512 83624c97582276f0d3efedaafee5b18730839fb100c1a18c84512ee34e45b4173e04f9c780b89411e89a6c3f81e24da78b8da04eb1aae0d99e304bc5f5864b99
SSDEEP 3072:/fWQ6ESTPnrfgIJKnuJitHEyRitb/zfdzSflJ:HWhEBkKnT2yRiIlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

myohii.exe

Path \Users\Admin\AppData\Local\Temp\myohii.exe
Size 123KB
SHA256 b81555762d4584988cfe55fe2cd9a6bc7cc231253d239877e0a0b406fc2e3fce
MD5 fa696b16f763f8820496eab98dff0733
SHA1 b04cca189b0561478f7cf2f393d1c9a2bbdf1eab
SHA512 83624c97582276f0d3efedaafee5b18730839fb100c1a18c84512ee34e45b4173e04f9c780b89411e89a6c3f81e24da78b8da04eb1aae0d99e304bc5f5864b99
SSDEEP 3072:/fWQ6ESTPnrfgIJKnuJitHEyRitb/zfdzSflJ:HWhEBkKnT2yRiIlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads