lokibot | 532c201d0ae011c0cdcdd8ddc806f9f9d9ca6042eec560d84bc3d6ceedff7542

General

Target
10fcb1f5896429d117ba8722068bd04d.exe
Size 123KB
Sample221024-prrm8agfhp
SHA256 532c201d0ae011c0cdcdd8ddc806f9f9d9ca6042eec560d84bc3d6ceedff7542
MD5 10fcb1f5896429d117ba8722068bd04d
SHA1 00d09634885d515a35aaa2f82271dc5029b40c53
SHA512 380d9129f7c22dbbf0efda0ae94fb3c18c8c0f0d5a94e69c8ec9d809c93a65dccc02d4ea407582c9f5cd8a3bfffed4ed2f492e351391b9a27dd7b81ab7cd52dc
SSDEEP 3072:qUJoFfWzzl+cSMdYjUf5ImgEw9RG2pDE8sNt6zGjvP2JK:qweEpdNf5IKqotYGjGI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.162/drostov/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
3544	tpczftrgb.exe
1336	tpczftrgb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	tpczftrgb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	tpczftrgb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	tpczftrgb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3544 set thread context of 1336	3544	tpczftrgb.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3544	tpczftrgb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	tpczftrgb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3544	3420	10fcb1f5896429d117ba8722068bd04d.exe	79
PID 3420 wrote to memory of 3544	3420	10fcb1f5896429d117ba8722068bd04d.exe	79
PID 3420 wrote to memory of 3544	3420	10fcb1f5896429d117ba8722068bd04d.exe	79
PID 3544 wrote to memory of 1336	3544	tpczftrgb.exe	81
PID 3544 wrote to memory of 1336	3544	tpczftrgb.exe	81
PID 3544 wrote to memory of 1336	3544	tpczftrgb.exe	81
PID 3544 wrote to memory of 1336	3544	tpczftrgb.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	tpczftrgb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	tpczftrgb.exe

C:\Users\Admin\AppData\Local\Temp\10fcb1f5896429d117ba8722068bd04d.exe
"C:\Users\Admin\AppData\Local\Temp\10fcb1f5896429d117ba8722068bd04d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe
  "C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe
    "C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nmnpdjtukvm.p

Path C:\Users\Admin\AppData\Local\Temp\nmnpdjtukvm.p
Size 104KB
SHA256 25f27d16ddae1e433331d0e0083a95200f74cba131a21f0231a0c5d1f7ec334e
MD5 43c67a6a4bf42e80fd2ea7ae67c3c267
SHA1 8982f1365384f41c19c05713b3dd4f5aab869429
SHA512 6f275b7535d281872ad8171b1934577da4a8456b508f9d416168cf359799e31506bf30826d9d74cbc637958b2eed0eeecbd49e63c6b5e30581015f75c1bcdc69
SSDEEP 1536:SMtzs5FU2b0bjcDIEhZDMnSWDuxnIrIK258bYtryNtT8EBlu6/Q7QZn3qbqPiHzm:SLKbj4vuS+S58bYRyDJq7O3q8
MD5 SHA1 SHA512 SSDEEP

Submit Download

rudcxugqdn.e

Path C:\Users\Admin\AppData\Local\Temp\rudcxugqdn.e
Size 5KB
SHA256 58e5f8904e735dfe8b19a46025e9f5fcb2b5a0a117b736a14ce6abca2b1661dd
MD5 79257542cad06deabd08df6ce1eb07ea
SHA1 a0a656b4fae15f432d408f617f5cc8811086fbef
SHA512 ae93e4e920d116768204b7b800b7b7dc89bbeecbc50a094395868684dc6cd67f3fe7a50a33e01659e8b6d7b72ea7b5924515db3163588c752147630700f6e139
SSDEEP 96:vSDWvM91F3EF0XEBsgXtLZTr3UamH/WONC07ygAQ2VWGGvX93CuICjKmlyVw7Qun:dE1qFdGGLZTrkamfWL07ygfTG+hCuI65
MD5 SHA1 SHA512 SSDEEP

Submit Download

tpczftrgb.exe

Path C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe
Size 6KB
SHA256 0e80aa2927f4039e1c60e4ef6de7ac7b59879e46408516531bf7832c68b38c0c
MD5 6f25fc2280042bb60f6aa1403279758a
SHA1 8873ee67fbaf39bf923850fec2109baf5aa40db5
SHA512 5f7bc593cbc728796de24ffd2f4749f64b6e6c6b12b323ed507d5b91793e43224ea67dcb6a0047bcd13b1cfd8b2529815bc65f6ab065f7bbcfe5901e0ee5dad6
SSDEEP 96:3LigUG3hy8W4sPopYEW+4oyn0Tv9uVb3x:+lGK4copYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

tpczftrgb.exe

Path C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe
Size 6KB
SHA256 0e80aa2927f4039e1c60e4ef6de7ac7b59879e46408516531bf7832c68b38c0c
MD5 6f25fc2280042bb60f6aa1403279758a
SHA1 8873ee67fbaf39bf923850fec2109baf5aa40db5
SHA512 5f7bc593cbc728796de24ffd2f4749f64b6e6c6b12b323ed507d5b91793e43224ea67dcb6a0047bcd13b1cfd8b2529815bc65f6ab065f7bbcfe5901e0ee5dad6
SSDEEP 96:3LigUG3hy8W4sPopYEW+4oyn0Tv9uVb3x:+lGK4copYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

tpczftrgb.exe

Path C:\Users\Admin\AppData\Local\Temp\tpczftrgb.exe
Size 6KB
SHA256 0e80aa2927f4039e1c60e4ef6de7ac7b59879e46408516531bf7832c68b38c0c
MD5 6f25fc2280042bb60f6aa1403279758a
SHA1 8873ee67fbaf39bf923850fec2109baf5aa40db5
SHA512 5f7bc593cbc728796de24ffd2f4749f64b6e6c6b12b323ed507d5b91793e43224ea67dcb6a0047bcd13b1cfd8b2529815bc65f6ab065f7bbcfe5901e0ee5dad6
SSDEEP 96:3LigUG3hy8W4sPopYEW+4oyn0Tv9uVb3x:+lGK4copYF+4oyn04
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1336-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads