lokibot | d90aa731797ca56d99b3101ac45fecd1cfddd79a58ab82ae61c7e74bd23eaecd

General

Target
Enquiry&Specification.exe
Size 168KB
Sample221018-ktaehafbf9
SHA256 d90aa731797ca56d99b3101ac45fecd1cfddd79a58ab82ae61c7e74bd23eaecd
MD5 8839536420ca3902a2d53da66dc3bce7
SHA1 6ece93f9ba8b89feb96971ed10707d0155dc61b2
SHA512 cbbf16af563177c3298d275d7a1c7d419615064fb9e91ddeecac9677998a942df8760bd44e8ced4f3b2e77573897feaedde6ea2b125b6e5cf37534b9bfd8eef1
SSDEEP 3072:mbG7N2kDTHUpou/brRBj1Zo0XmZDttZV23uoy/xioQ8ZsjrhoohaHtwR/Q2lJ5yH:mbE/HUbzj1Zo0XIE+oUnKqohaUQG5yGW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
620	uqpojdeiak.exe

Loads dropped DLL 3 IoCs

pid	Process
1448	Enquiry&Specification.exe
620	uqpojdeiak.exe
320	uqpojdeiak.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uqpojdeiak.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uqpojdeiak.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	uqpojdeiak.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 320	620	uqpojdeiak.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	uqpojdeiak.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 620	1448	Enquiry&Specification.exe	27
PID 1448 wrote to memory of 620	1448	Enquiry&Specification.exe	27
PID 1448 wrote to memory of 620	1448	Enquiry&Specification.exe	27
PID 1448 wrote to memory of 620	1448	Enquiry&Specification.exe	27
PID 620 wrote to memory of 320	620	uqpojdeiak.exe	28
PID 620 wrote to memory of 320	620	uqpojdeiak.exe	28
PID 620 wrote to memory of 320	620	uqpojdeiak.exe	28
PID 620 wrote to memory of 320	620	uqpojdeiak.exe	28
PID 620 wrote to memory of 320	620	uqpojdeiak.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uqpojdeiak.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uqpojdeiak.exe

C:\Users\Admin\AppData\Local\Temp\Enquiry&Specification.exe
"C:\Users\Admin\AppData\Local\Temp\Enquiry&Specification.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
  "C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
    "C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hrfgdxfqay.oyz

Path C:\Users\Admin\AppData\Local\Temp\hrfgdxfqay.oyz
Size 4KB
SHA256 2bcd40110679aa95fb1a7417a76f41ecbb5dd361cea8c82d0efc4e0e3741c9a1
MD5 c9370e8c447500168b2a0cf1e7e62688
SHA1 8c3ccfd2cfe2275e392318b7130ae91401840e6d
SHA512 c68138fb58cd5e03f37267278657e4dd7044ba16119bcea7633384470edff3bf45c8fb8c70f3aab8749f20b1c8d01b938d3a937bd0caf59e270856b741f57d93
SSDEEP 96:zVp7qmke1+qUm3Yqulijd6Z889f15w+v4VvPyJba/tiGarFgs:zV5f1+qY68Zjhw+4ob5GarFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

inboofwdons.ys

Path C:\Users\Admin\AppData\Local\Temp\inboofwdons.ys
Size 104KB
SHA256 f379af73ce60c3d26e4b1316f70e7bb399ff661a865aaea43f2d81d388434f0b
MD5 045ae448995c812a7b95c5bb5f476308
SHA1 21f5a5ec7a642aff4271101a935e501a7e3d6fab
SHA512 14261c53654cb70bf9360913d0c4548d5ed39ec58c0dde5fc54d8b343a83fa805425dadba85097b1ed3a83138fb1e69c88570df335789773ce57eb34820a67fd
SSDEEP 3072:kmbOwVC3Svv3W2mkIV3YuhTkfvyZlGqLOtal7M7aR6y6:k8XhrmkO3YuhcvyZlGqCslQ7aEL
MD5 SHA1 SHA512 SSDEEP

Submit Download

uqpojdeiak.exe

Path C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
Size 59KB
SHA256 d47cc9a39d754b567ea8c9478bfec4a1a7364e1abfaa09d7795291baba72284a
MD5 d85480ce71f31aa962e5d11f2e5af6ce
SHA1 414b2c55c4cefc096a2102e2006b8330d44a5f56
SHA512 c8fb5d40f53d048771894532909b4dde48c52eeee1b9c085b77c874c819c8542069673682dfd4bdc570a974d7069139917c5eb5a34cffab67d0c5534a9aeb6f0
SSDEEP 1536:GvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:GCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uqpojdeiak.exe

Path C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
Size 59KB
SHA256 d47cc9a39d754b567ea8c9478bfec4a1a7364e1abfaa09d7795291baba72284a
MD5 d85480ce71f31aa962e5d11f2e5af6ce
SHA1 414b2c55c4cefc096a2102e2006b8330d44a5f56
SHA512 c8fb5d40f53d048771894532909b4dde48c52eeee1b9c085b77c874c819c8542069673682dfd4bdc570a974d7069139917c5eb5a34cffab67d0c5534a9aeb6f0
SSDEEP 1536:GvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:GCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uqpojdeiak.exe

Path C:\Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
Size 59KB
SHA256 d47cc9a39d754b567ea8c9478bfec4a1a7364e1abfaa09d7795291baba72284a
MD5 d85480ce71f31aa962e5d11f2e5af6ce
SHA1 414b2c55c4cefc096a2102e2006b8330d44a5f56
SHA512 c8fb5d40f53d048771894532909b4dde48c52eeee1b9c085b77c874c819c8542069673682dfd4bdc570a974d7069139917c5eb5a34cffab67d0c5534a9aeb6f0
SSDEEP 1536:GvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:GCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uqpojdeiak.exe

Path \Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
Size 59KB
SHA256 d47cc9a39d754b567ea8c9478bfec4a1a7364e1abfaa09d7795291baba72284a
MD5 d85480ce71f31aa962e5d11f2e5af6ce
SHA1 414b2c55c4cefc096a2102e2006b8330d44a5f56
SHA512 c8fb5d40f53d048771894532909b4dde48c52eeee1b9c085b77c874c819c8542069673682dfd4bdc570a974d7069139917c5eb5a34cffab67d0c5534a9aeb6f0
SSDEEP 1536:GvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:GCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uqpojdeiak.exe

Path \Users\Admin\AppData\Local\Temp\uqpojdeiak.exe
Size 59KB
SHA256 d47cc9a39d754b567ea8c9478bfec4a1a7364e1abfaa09d7795291baba72284a
MD5 d85480ce71f31aa962e5d11f2e5af6ce
SHA1 414b2c55c4cefc096a2102e2006b8330d44a5f56
SHA512 c8fb5d40f53d048771894532909b4dde48c52eeee1b9c085b77c874c819c8542069673682dfd4bdc570a974d7069139917c5eb5a34cffab67d0c5534a9aeb6f0
SSDEEP 1536:GvtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:GCsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads