lokibot | 9460380ecaa71efc2b25dd19f0782e93380b5743ae4e2cfb218e40ca46cea7fc

General

Target
313554afd5367d4ac36c1486988f1215.exe
Size 124KB
Sample221024-wlwtbahhg3
SHA256 9460380ecaa71efc2b25dd19f0782e93380b5743ae4e2cfb218e40ca46cea7fc
MD5 313554afd5367d4ac36c1486988f1215
SHA1 17ead0ef767243d10bedf644f67459396ac1448a
SHA512 d3f5a53f235936b2bf563ecb3e82c726044f943399d157ddc0e4194b7d27b866d8191660cbb3087e9d092e81e7e670f0b66bf3a17435ad2ace19bb263e03d75a
SSDEEP 3072:qUJoFfWzzl+cSMl/6ERZ7cDCo3sTudRgVRMgsJw3HzTBSm:qweEpIER2DCocWyugsJw3HzN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.162/drostov/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
4912	ziletivjkm.exe
4052	ziletivjkm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ziletivjkm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ziletivjkm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ziletivjkm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4052	4912	ziletivjkm.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4912	ziletivjkm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	ziletivjkm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4912	4016	313554afd5367d4ac36c1486988f1215.exe	83
PID 4016 wrote to memory of 4912	4016	313554afd5367d4ac36c1486988f1215.exe	83
PID 4016 wrote to memory of 4912	4016	313554afd5367d4ac36c1486988f1215.exe	83
PID 4912 wrote to memory of 4052	4912	ziletivjkm.exe	85
PID 4912 wrote to memory of 4052	4912	ziletivjkm.exe	85
PID 4912 wrote to memory of 4052	4912	ziletivjkm.exe	85
PID 4912 wrote to memory of 4052	4912	ziletivjkm.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ziletivjkm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ziletivjkm.exe

C:\Users\Admin\AppData\Local\Temp\313554afd5367d4ac36c1486988f1215.exe
"C:\Users\Admin\AppData\Local\Temp\313554afd5367d4ac36c1486988f1215.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe
  "C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe
    "C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qnwlhdishdp.ol

Path C:\Users\Admin\AppData\Local\Temp\qnwlhdishdp.ol
Size 104KB
SHA256 adfd3090ed2e82fa37ff190c4011c1dc9c999d6c553b30d8d456ed6971e54d0c
MD5 6030d6c3972b8497e94e842121b9fc3b
SHA1 dc85a209ed4a49bf2bbba5ee7800f0428ce4c8d4
SHA512 afc7f3d6627e476776e5164f9bd2ce1b53e404b9efda4921d4037a529a536ec8f86f1049c01d95af5de66e8624d07673246f1c1a237fbf6ba7189558fc21f1a6
SSDEEP 1536:bzzqRl4Q3+J/SwyCUQC0URfpJ6zi+0WMMOossfte8fv0tC+BRk4Msj385cs:/z7W+lAhJb8M4v6E+BZj3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmfdvjlp.fid

Path C:\Users\Admin\AppData\Local\Temp\tmfdvjlp.fid
Size 5KB
SHA256 b8a79be4b3ecad4bdda3a2a305e375fe9da6c46198bdf3d6511faa497a4ffabc
MD5 be87bb8758c1e557f5e78fd3cb990e3b
SHA1 c338e33c57c3d527a125d7e13b04273271eb0863
SHA512 f0103a89d3695213a08d261ffc285a34c0b35b05c41b8d45d7698104a4e597d2d66a5e8baf67d71263101465d87b27a309c6b216673bcca34a870b5bae3a9910
SSDEEP 96:jpy3Vz80jD37mhi1EZmTkEYQu9H8Kf38SWGdQWCM91EhoMzXvj7Cx3uTEbSBatOn:1ylY0P6hi1EZmTkVH88sSWdWCM95MzLj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ziletivjkm.exe

Path C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe
Size 6KB
SHA256 4ee4138a10f12f2bbce850d3a0b3179b928e3ad2dc0d502f606358dc3c187d59
MD5 ad3d6b5342203eb2ae1d29759e62b4b0
SHA1 d9565d40cfa16baf8331aaa99e0eef98dd7adab9
SHA512 4fcc595797025935181f0c466e3af23105e1c959505c0a24f033cb77eec30f2258570476a687172a497e1f5ed62c39fbdebf10ba3fe4e85392d97ec5e0579f6f
SSDEEP 96:WEU7QVO2ih2N7vJb7v914m5Rn091u4oynmpDipshupsIQbnx:w7QVO2PlvJv9em5i984oyneDKAup
MD5 SHA1 SHA512 SSDEEP

Submit Download

ziletivjkm.exe

Path C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe
Size 6KB
SHA256 4ee4138a10f12f2bbce850d3a0b3179b928e3ad2dc0d502f606358dc3c187d59
MD5 ad3d6b5342203eb2ae1d29759e62b4b0
SHA1 d9565d40cfa16baf8331aaa99e0eef98dd7adab9
SHA512 4fcc595797025935181f0c466e3af23105e1c959505c0a24f033cb77eec30f2258570476a687172a497e1f5ed62c39fbdebf10ba3fe4e85392d97ec5e0579f6f
SSDEEP 96:WEU7QVO2ih2N7vJb7v914m5Rn091u4oynmpDipshupsIQbnx:w7QVO2PlvJv9em5i984oyneDKAup
MD5 SHA1 SHA512 SSDEEP

Submit Download

ziletivjkm.exe

Path C:\Users\Admin\AppData\Local\Temp\ziletivjkm.exe
Size 6KB
SHA256 4ee4138a10f12f2bbce850d3a0b3179b928e3ad2dc0d502f606358dc3c187d59
MD5 ad3d6b5342203eb2ae1d29759e62b4b0
SHA1 d9565d40cfa16baf8331aaa99e0eef98dd7adab9
SHA512 4fcc595797025935181f0c466e3af23105e1c959505c0a24f033cb77eec30f2258570476a687172a497e1f5ed62c39fbdebf10ba3fe4e85392d97ec5e0579f6f
SSDEEP 96:WEU7QVO2ih2N7vJb7v914m5Rn091u4oynmpDipshupsIQbnx:w7QVO2PlvJv9em5i984oyneDKAup
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4052-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4052-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads