lokibot | 7db764dd4ae52c134585ef5e1fd266448d12c45e2a5e4a6665de764c6e05fdf7

General

Target
Revised PO-20221024.exe
Size 125KB
Sample221024-kbvmqaffck
SHA256 7db764dd4ae52c134585ef5e1fd266448d12c45e2a5e4a6665de764c6e05fdf7
MD5 2daa65a9963a5c01fd87fb5afdedf3b5
SHA1 9da9fcb3d34598b7de0af349cda1ad94a90918a4
SHA512 7ef29dc740a2bf0277c5bd3224728991407e56389a1cb89afeab9d1fa5baedd19e2dd71670d32a52a144f9d501cf1d2595375e6bcf282146f287c78bc79ba38f
SSDEEP 3072:qUJoFfWzzl+cSMU7ABjbXLC7bx7jlXUmevbRF1KdASBuJKMXPxDlN:qweEpU8BP+7b3Wvb1KdrwLPxBN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/rossumploits/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1480	vszgbykb.exe
1560	vszgbykb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vszgbykb.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vszgbykb.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vszgbykb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udvfdndghp = "C:\\Users\\Admin\\AppData\\Roaming\\eocjebwphcvdx\\locsqayi.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\vszgbykb.exe\""	vszgbykb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 1560	1480	vszgbykb.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1480	vszgbykb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	vszgbykb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1480	4796	Revised PO-20221024.exe	83
PID 4796 wrote to memory of 1480	4796	Revised PO-20221024.exe	83
PID 4796 wrote to memory of 1480	4796	Revised PO-20221024.exe	83
PID 1480 wrote to memory of 1560	1480	vszgbykb.exe	85
PID 1480 wrote to memory of 1560	1480	vszgbykb.exe	85
PID 1480 wrote to memory of 1560	1480	vszgbykb.exe	85
PID 1480 wrote to memory of 1560	1480	vszgbykb.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vszgbykb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vszgbykb.exe

C:\Users\Admin\AppData\Local\Temp\Revised PO-20221024.exe
"C:\Users\Admin\AppData\Local\Temp\Revised PO-20221024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe
  "C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe
    "C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioezo.p

Path C:\Users\Admin\AppData\Local\Temp\ioezo.p
Size 104KB
SHA256 c107d3b92eff6bde2e5da3ee9440e6536065c9121f15ce785a947450884a2aca
MD5 06c4c6420fb6b96981770a8d7988cd72
SHA1 35a11a72e7adcadfa5cb2400cf3a8af9a4750152
SHA512 d5e934e9a6e84a3a8fc4699b7d52b4730e37db456b06994fc806fb126bc434ea635cc71ca36fd8d4051e391529c1e275d1cae0edddd3b468cdfb25a2e579090e
SSDEEP 3072:iv3dfSpRE2bpRaCdBF4PErugJi9msyG8yibss1:q3NSprooFwSKu+ibJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iygawm.tt

Path C:\Users\Admin\AppData\Local\Temp\iygawm.tt
Size 7KB
SHA256 3456ff6aa9af2f340068e89ae36e40437fd0c95fdefe4e7e31b0b32549486ab7
MD5 c70d03f2adf48741a080b61a9750a71f
SHA1 ac2fbad022d0cfeb0457f7fa74178fbc2a2500f4
SHA512 4caef3eed7874b18b334722fea133d6836585b38a001e60081e2d29b3a20cc1e5f56c17fa19fa281243d1643b80b365f117a4cb0b10e2ce7a477d8d50179cf30
SSDEEP 192:VTVJ2TggRR9erZBrSV7GmRmQuIljdUVnfk9z+M8ozVs6pSJyS:dVJA792ZBrSZ3RmQLzUVfOSM8GV/+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

vszgbykb.exe

Path C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe
Size 6KB
SHA256 a652dcc0129f37b0f495a2e16c8e5299a979f8060cf56bf57b642b8af5ff764c
MD5 ed8e1b506859eb8c2a564a5ebfa7dc28
SHA1 7e75711401e98b106de23d426c3e0467becbf44a
SHA512 23eb75f9427cea2150e848bf2b9426b0aa3a895c8ae42f7990c6930024f249fa98a87df29ae20e0d4fe5f73c52baaa53ba53ebe5d80f21b1878ca36fa72a826e
SSDEEP 96:3Z4jKhEAHnmmUEpEtW4rppYEW+4oyn0Tv9udbXx:p4jP1IV4rppYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

vszgbykb.exe

Path C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe
Size 6KB
SHA256 a652dcc0129f37b0f495a2e16c8e5299a979f8060cf56bf57b642b8af5ff764c
MD5 ed8e1b506859eb8c2a564a5ebfa7dc28
SHA1 7e75711401e98b106de23d426c3e0467becbf44a
SHA512 23eb75f9427cea2150e848bf2b9426b0aa3a895c8ae42f7990c6930024f249fa98a87df29ae20e0d4fe5f73c52baaa53ba53ebe5d80f21b1878ca36fa72a826e
SSDEEP 96:3Z4jKhEAHnmmUEpEtW4rppYEW+4oyn0Tv9udbXx:p4jP1IV4rppYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

vszgbykb.exe

Path C:\Users\Admin\AppData\Local\Temp\vszgbykb.exe
Size 6KB
SHA256 a652dcc0129f37b0f495a2e16c8e5299a979f8060cf56bf57b642b8af5ff764c
MD5 ed8e1b506859eb8c2a564a5ebfa7dc28
SHA1 7e75711401e98b106de23d426c3e0467becbf44a
SHA512 23eb75f9427cea2150e848bf2b9426b0aa3a895c8ae42f7990c6930024f249fa98a87df29ae20e0d4fe5f73c52baaa53ba53ebe5d80f21b1878ca36fa72a826e
SSDEEP 96:3Z4jKhEAHnmmUEpEtW4rppYEW+4oyn0Tv9udbXx:p4jP1IV4rppYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1560-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1560-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads