lokibot | dccb778387d26b2364ceec6e9099f78f8da0f1f2c13d987eeb9fb51cc48e19d6

General

Target
Revised Company_Handbook_pdf.exe
Size 175KB
Sample221020-1c14wsfef2
SHA256 dccb778387d26b2364ceec6e9099f78f8da0f1f2c13d987eeb9fb51cc48e19d6
MD5 1b7ef597519c9aceeb009466b95905c0
SHA1 41fcca20ae3db9ef43caf468d1b7698cc6cb8feb
SHA512 39693f1b222f0e55b2598263e79d1cb7a44ff545dedc8b2bc7017363a00a8a3b954d7d9c906c6568cc2decfd416e241cbdb1b48e1894bb10dfbb1159382807d2
SSDEEP 3072:mbG7N2kDTHUpou/b9psmJOd9EtY/Myh1J6hcwaaHT1f8Et85GXXgZ9YO+dIm2eeq:mbE/HUbDEdgyR6rHTi69g7YRj2flo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 1 IoCs

pid	Process
1176	kcorpxneaj.exe

Loads dropped DLL 3 IoCs

pid	Process
288	Revised Company_Handbook_pdf.exe
1176	kcorpxneaj.exe
1492	kcorpxneaj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	kcorpxneaj.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	kcorpxneaj.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	kcorpxneaj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 1492	1176	kcorpxneaj.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	kcorpxneaj.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1176	288	Revised Company_Handbook_pdf.exe	26
PID 288 wrote to memory of 1176	288	Revised Company_Handbook_pdf.exe	26
PID 288 wrote to memory of 1176	288	Revised Company_Handbook_pdf.exe	26
PID 288 wrote to memory of 1176	288	Revised Company_Handbook_pdf.exe	26
PID 1176 wrote to memory of 1492	1176	kcorpxneaj.exe	27
PID 1176 wrote to memory of 1492	1176	kcorpxneaj.exe	27
PID 1176 wrote to memory of 1492	1176	kcorpxneaj.exe	27
PID 1176 wrote to memory of 1492	1176	kcorpxneaj.exe	27
PID 1176 wrote to memory of 1492	1176	kcorpxneaj.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	kcorpxneaj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	kcorpxneaj.exe

C:\Users\Admin\AppData\Local\Temp\Revised Company_Handbook_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Revised Company_Handbook_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
  "C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
    "C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hdstsmp.f

Path C:\Users\Admin\AppData\Local\Temp\hdstsmp.f
Size 104KB
SHA256 438ff78eaf354d7680246e6a27b38e8912d87ee21f46b186a667ca8b042cc316
MD5 bb5bfd8c62984f9465eac86bc2a6c148
SHA1 5bcb764fffc85dd7f37c88265c612c8ef7e38302
SHA512 bcbd216a47b53f2aaefa7e38fc1b22dd918dbdc16fed85cbcd56c1fb04a244a611c86df4970f933c707984d2de27902cd268db1c676ce0ecab0f31d2d4b7a8fa
SSDEEP 3072:k+pBYfc0LqYfclcEKULZwJkrzwWbIVUOZB:tsc0O5uDaaHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcorpxneaj.exe

Path C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
Size 74KB
SHA256 9e108a6d9bcc68087f63ee3432cb167fc73b95eadb9453a6a78bef995f3a1216
MD5 ab0e54a3090817a83dbe173d7d951469
SHA1 60a004b06eea152d2bef1594934bc8bed15f67ed
SHA512 dd2439c654935354935b407cbc41fdb74ccb7a5c5fb6b17b3b156082537d9d171abdcb4c7363f20434d710e69bd8620df97fd307778ddb54136eff6c5be02c3c
SSDEEP 1536:/Z47WEYxtX4N6pWJ9RdWr/YjcCzT9cbM4F4GVHPeKJ/zJ5sWRScdZD+6Ia:/n4N6pWJXqCzT9cbM46GtxzPZa6Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcorpxneaj.exe

Path C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
Size 74KB
SHA256 9e108a6d9bcc68087f63ee3432cb167fc73b95eadb9453a6a78bef995f3a1216
MD5 ab0e54a3090817a83dbe173d7d951469
SHA1 60a004b06eea152d2bef1594934bc8bed15f67ed
SHA512 dd2439c654935354935b407cbc41fdb74ccb7a5c5fb6b17b3b156082537d9d171abdcb4c7363f20434d710e69bd8620df97fd307778ddb54136eff6c5be02c3c
SSDEEP 1536:/Z47WEYxtX4N6pWJ9RdWr/YjcCzT9cbM4F4GVHPeKJ/zJ5sWRScdZD+6Ia:/n4N6pWJXqCzT9cbM46GtxzPZa6Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcorpxneaj.exe

Path C:\Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
Size 74KB
SHA256 9e108a6d9bcc68087f63ee3432cb167fc73b95eadb9453a6a78bef995f3a1216
MD5 ab0e54a3090817a83dbe173d7d951469
SHA1 60a004b06eea152d2bef1594934bc8bed15f67ed
SHA512 dd2439c654935354935b407cbc41fdb74ccb7a5c5fb6b17b3b156082537d9d171abdcb4c7363f20434d710e69bd8620df97fd307778ddb54136eff6c5be02c3c
SSDEEP 1536:/Z47WEYxtX4N6pWJ9RdWr/YjcCzT9cbM4F4GVHPeKJ/zJ5sWRScdZD+6Ia:/n4N6pWJXqCzT9cbM46GtxzPZa6Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

nyvqmavgta.on

Path C:\Users\Admin\AppData\Local\Temp\nyvqmavgta.on
Size 4KB
SHA256 52d67b4c898edc6de62fe58ce82a8fe7b2e77258a8407fe8a51f6d454d6e4f98
MD5 97ff92ac0197e441f5d8928f2048e561
SHA1 d8521053c0009c4ddf72b0789b47447b676fb0cf
SHA512 f189d7e1f8bd9c32ac9342e346754be84cd61adf9fdc611407386dd407757b02867720ce00bb2fc94eac0fdf34c379b7e59cc3a2ac4012396335ee0183260465
SSDEEP 96:B2p8Suqgta5hGqVRxV4h/syCt5kRX8NRKT0iC2Zd6yoC4BZ:8pOqgIq0vVyCtlK8qdhB4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcorpxneaj.exe

Path \Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
Size 74KB
SHA256 9e108a6d9bcc68087f63ee3432cb167fc73b95eadb9453a6a78bef995f3a1216
MD5 ab0e54a3090817a83dbe173d7d951469
SHA1 60a004b06eea152d2bef1594934bc8bed15f67ed
SHA512 dd2439c654935354935b407cbc41fdb74ccb7a5c5fb6b17b3b156082537d9d171abdcb4c7363f20434d710e69bd8620df97fd307778ddb54136eff6c5be02c3c
SSDEEP 1536:/Z47WEYxtX4N6pWJ9RdWr/YjcCzT9cbM4F4GVHPeKJ/zJ5sWRScdZD+6Ia:/n4N6pWJXqCzT9cbM46GtxzPZa6Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcorpxneaj.exe

Path \Users\Admin\AppData\Local\Temp\kcorpxneaj.exe
Size 74KB
SHA256 9e108a6d9bcc68087f63ee3432cb167fc73b95eadb9453a6a78bef995f3a1216
MD5 ab0e54a3090817a83dbe173d7d951469
SHA1 60a004b06eea152d2bef1594934bc8bed15f67ed
SHA512 dd2439c654935354935b407cbc41fdb74ccb7a5c5fb6b17b3b156082537d9d171abdcb4c7363f20434d710e69bd8620df97fd307778ddb54136eff6c5be02c3c
SSDEEP 1536:/Z47WEYxtX4N6pWJ9RdWr/YjcCzT9cbM4F4GVHPeKJ/zJ5sWRScdZD+6Ia:/n4N6pWJXqCzT9cbM46GtxzPZa6Ia
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/288-54-0x0000000075351000-0x0000000075353000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads