lokibot | c5dafabab462b9726bc0dc16cc523fa3432c40d0698c62db0c1dd5d5ff097fee

Resubmissions

10/10/2022, 15:26

221010-svaewscegn10

10/10/2022, 15:11

221010-skk4msccf610

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5b7ea9ec17c2e44cf3ab53050f8bfad.exe
Size 184KB
Sample221010-skk4msccf6
SHA256 c5dafabab462b9726bc0dc16cc523fa3432c40d0698c62db0c1dd5d5ff097fee
MD5 e5b7ea9ec17c2e44cf3ab53050f8bfad
SHA1 703fd35dc0a7c7d04f8db7ec1697a3c592489a8a
SHA512 5fae9adf628b3812f89ae6e2479ed1b10f26940be955e944bbb27b7860b4150dfc45b2d7f0015d915f875fdb9ce2f9a52ed105a1c3d454499dbffcf510255845
SSDEEP 3072:l1NjcVVnLpPunbOnKfquOxxtIZtYPyHbQzwbeWpWEM2lvneXafPlDls1y3S5K/mj:HNeZmt4xtRGbewbJWE5neqNcy3S4MT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
4796	dbhbitn.exe

Loads dropped DLL 1 IoCs

pid	Process
1124	dbhbitn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dbhbitn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dbhbitn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dbhbitn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 1124	4796	dbhbitn.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	4796	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	dbhbitn.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4796	1268	e5b7ea9ec17c2e44cf3ab53050f8bfad.exe	82
PID 1268 wrote to memory of 4796	1268	e5b7ea9ec17c2e44cf3ab53050f8bfad.exe	82
PID 1268 wrote to memory of 4796	1268	e5b7ea9ec17c2e44cf3ab53050f8bfad.exe	82
PID 4796 wrote to memory of 1124	4796	dbhbitn.exe	83
PID 4796 wrote to memory of 1124	4796	dbhbitn.exe	83
PID 4796 wrote to memory of 1124	4796	dbhbitn.exe	83
PID 4796 wrote to memory of 1124	4796	dbhbitn.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dbhbitn.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dbhbitn.exe

C:\Users\Admin\AppData\Local\Temp\e5b7ea9ec17c2e44cf3ab53050f8bfad.exe
"C:\Users\Admin\AppData\Local\Temp\e5b7ea9ec17c2e44cf3ab53050f8bfad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe
  "C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe
    "C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 504
    3⤵
    - Program crash
    PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4796 -ip 4796
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbhbitn.exe

Path C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe
Size 123KB
SHA256 1a94f183f4f850f5897063ca9588d90a0e5e51317deb69c86deb4d3082002ccd
MD5 fe07e6d4ab2226177613eebc29b3fbd0
SHA1 5c59fa5d55ea758ab461cd0d9760260b568f3637
SHA512 475f11a76a1412c0805bf8d62e8f74eec74960d50997988838cdb6706d3ac6447140162997f8547da384ea43609ace114e2f1ea37de8b89c7064a22671ae71f2
SSDEEP 3072:KfWQ6ESTPnrfN6uc3CYeq3ooebUyxS/nplZbK65HMi3n:wWhEGTc3Oq3oo/yx6V53n
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbhbitn.exe

Path C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe
Size 123KB
SHA256 1a94f183f4f850f5897063ca9588d90a0e5e51317deb69c86deb4d3082002ccd
MD5 fe07e6d4ab2226177613eebc29b3fbd0
SHA1 5c59fa5d55ea758ab461cd0d9760260b568f3637
SHA512 475f11a76a1412c0805bf8d62e8f74eec74960d50997988838cdb6706d3ac6447140162997f8547da384ea43609ace114e2f1ea37de8b89c7064a22671ae71f2
SSDEEP 3072:KfWQ6ESTPnrfN6uc3CYeq3ooebUyxS/nplZbK65HMi3n:wWhEGTc3Oq3oo/yx6V53n
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbhbitn.exe

Path C:\Users\Admin\AppData\Local\Temp\dbhbitn.exe
Size 123KB
SHA256 1a94f183f4f850f5897063ca9588d90a0e5e51317deb69c86deb4d3082002ccd
MD5 fe07e6d4ab2226177613eebc29b3fbd0
SHA1 5c59fa5d55ea758ab461cd0d9760260b568f3637
SHA512 475f11a76a1412c0805bf8d62e8f74eec74960d50997988838cdb6706d3ac6447140162997f8547da384ea43609ace114e2f1ea37de8b89c7064a22671ae71f2
SSDEEP 3072:KfWQ6ESTPnrfN6uc3CYeq3ooebUyxS/nplZbK65HMi3n:wWhEGTc3Oq3oo/yx6V53n
MD5 SHA1 SHA512 SSDEEP

Submit Download

ijpoidaei.or

Path C:\Users\Admin\AppData\Local\Temp\ijpoidaei.or
Size 4KB
SHA256 fe1d992234600c26e9083bbc6043238153d6791a02edc5f93f8f06aba10cc2e9
MD5 5d0d4288c0dd08625fa8a4ec6bbbadfc
SHA1 1442220a200c78bc7af1f25981b89f48d5fd9fb0
SHA512 a44ba337139baf33941968c595fc500ce585374fa00721b97e9a7e97cfb9c72b2ae6d430126210a90d1d477e71ec1d14de6b1704600bd85863b2a826e23c2856
SSDEEP 96:261J1McYEp+78/9/tt0relMJLf55vPPaHKMAMzVozxnMYtKwTI8mc+k1Fe:H1Mva+4/13fqLf55XhKzadMYtKMP0Oe
MD5 SHA1 SHA512 SSDEEP

Submit Download

irgumcbyf.n

Path C:\Users\Admin\AppData\Local\Temp\irgumcbyf.n
Size 104KB
SHA256 29b58e11c8d53d7477ad83c4b199e4f9fac268f8e918fe64415072be9509148e
MD5 38e5f70486820055bdc11212d44e4322
SHA1 acf14754626946b50b3d1e8671725fe448b4b918
SHA512 740cd283d54155d7a9e3d7f65bdff8df6b6693dea0dc9737e27c0762b1f5f13569ccdfdaaa083de74be21efe5cfb35e7b724001cf52372cd1be80e6c1c6fd5ba
SSDEEP 3072:oF/MG80FQZC5AUWAQCokjMcNi6bgcYvnyifFVjY1:oF/cCQxN4mhccnyifFhY1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads