lokibot | ad5a2c0255a910242f0befdc84972a13179ee08dcdfdc24d7b72bdf9f7b8cff0

General

Target
SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe
Size 134KB
Sample221122-e5yctaac84
SHA256 ad5a2c0255a910242f0befdc84972a13179ee08dcdfdc24d7b72bdf9f7b8cff0
MD5 fde6c6fb03431a9dd0f1f4f7228d460c
SHA1 764c2679f158af854e28d180c441d2eb8dcc42fe
SHA512 433f07f0dc5f1e5ed1e0c6c6650951b19ee1ee29c19f892fe703790ceaa4821b861ab2ea64865132ca04acb26fb6c053e64820e94049399df25efcf1cf0fb99e
SSDEEP 3072:WfJSq+ytGIon9KcSMDSSWjy+IUbdFby+TYW4n0BA7UEx96c7xEmSf:MEa0NDJWnIu5y+TBEH6iO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 3 IoCs

pid	Process
4952	hqephfbe.exe
724	hqephfbe.exe
1220	hqephfbe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	hqephfbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	hqephfbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	hqephfbe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 1220	4952	hqephfbe.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4952	hqephfbe.exe
4952	hqephfbe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	hqephfbe.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4952	4624	SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe	76
PID 4624 wrote to memory of 4952	4624	SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe	76
PID 4624 wrote to memory of 4952	4624	SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe	76
PID 4952 wrote to memory of 724	4952	hqephfbe.exe	78
PID 4952 wrote to memory of 724	4952	hqephfbe.exe	78
PID 4952 wrote to memory of 724	4952	hqephfbe.exe	78
PID 4952 wrote to memory of 1220	4952	hqephfbe.exe	79
PID 4952 wrote to memory of 1220	4952	hqephfbe.exe	79
PID 4952 wrote to memory of 1220	4952	hqephfbe.exe	79
PID 4952 wrote to memory of 1220	4952	hqephfbe.exe	79

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	hqephfbe.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	hqephfbe.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.857.19652.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
  "C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe" C:\Users\Admin\AppData\Local\Temp\mpeknsug.ll
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
    "C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe" C:\Users\Admin\AppData\Local\Temp\mpeknsug.ll
    3⤵
    - Executes dropped EXE
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
    "C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe" C:\Users\Admin\AppData\Local\Temp\mpeknsug.ll
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hqephfbe.exe

Path C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
Size 7KB
SHA256 5709be3d10cb56cbcd11f4bb0385b2dc34fa2bed77b3f23a20ee34675aa8f74a
MD5 0ff6d0911ffbe132664b20ecd215fb2d
SHA1 ed690437d9d19ec0e66781a29d7a7366a92331ae
SHA512 57366280b122f0483666a8985f516d2e8a3c848cfac0d770a452fb6a285ba5599b4dfb0a7c8c4a9dac331cdf36b4d0fc7963f35785171bdecab2825bb05d0435
SSDEEP 96:0ei0QHWeZVjZuMm/HYdkrp6ddkSPOoynlnE7plgt2/WWK1SrxP9:01045RKHYOpa5POoynlEtl7+WN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqephfbe.exe

Path C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
Size 7KB
SHA256 5709be3d10cb56cbcd11f4bb0385b2dc34fa2bed77b3f23a20ee34675aa8f74a
MD5 0ff6d0911ffbe132664b20ecd215fb2d
SHA1 ed690437d9d19ec0e66781a29d7a7366a92331ae
SHA512 57366280b122f0483666a8985f516d2e8a3c848cfac0d770a452fb6a285ba5599b4dfb0a7c8c4a9dac331cdf36b4d0fc7963f35785171bdecab2825bb05d0435
SSDEEP 96:0ei0QHWeZVjZuMm/HYdkrp6ddkSPOoynlnE7plgt2/WWK1SrxP9:01045RKHYOpa5POoynlEtl7+WN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqephfbe.exe

Path C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
Size 7KB
SHA256 5709be3d10cb56cbcd11f4bb0385b2dc34fa2bed77b3f23a20ee34675aa8f74a
MD5 0ff6d0911ffbe132664b20ecd215fb2d
SHA1 ed690437d9d19ec0e66781a29d7a7366a92331ae
SHA512 57366280b122f0483666a8985f516d2e8a3c848cfac0d770a452fb6a285ba5599b4dfb0a7c8c4a9dac331cdf36b4d0fc7963f35785171bdecab2825bb05d0435
SSDEEP 96:0ei0QHWeZVjZuMm/HYdkrp6ddkSPOoynlnE7plgt2/WWK1SrxP9:01045RKHYOpa5POoynlEtl7+WN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqephfbe.exe

Path C:\Users\Admin\AppData\Local\Temp\hqephfbe.exe
Size 7KB
SHA256 5709be3d10cb56cbcd11f4bb0385b2dc34fa2bed77b3f23a20ee34675aa8f74a
MD5 0ff6d0911ffbe132664b20ecd215fb2d
SHA1 ed690437d9d19ec0e66781a29d7a7366a92331ae
SHA512 57366280b122f0483666a8985f516d2e8a3c848cfac0d770a452fb6a285ba5599b4dfb0a7c8c4a9dac331cdf36b4d0fc7963f35785171bdecab2825bb05d0435
SSDEEP 96:0ei0QHWeZVjZuMm/HYdkrp6ddkSPOoynlnE7plgt2/WWK1SrxP9:01045RKHYOpa5POoynlEtl7+WN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpeknsug.ll

Path C:\Users\Admin\AppData\Local\Temp\mpeknsug.ll
Size 5KB
SHA256 27bafb4781ac4fb0969a65080d49f5d00c40540d62ce77fa1fd7896f262d46c4
MD5 536d2dd4e8acf4d1545aa7bf8b171263
SHA1 476289da25e62be8bf41d682e7d730ab9d4d7e1b
SHA512 c6dd9be8c9918068b602707a7287837f7adafcd509b5da5ea3470172629ba94096ea43d7f95d8d7704fdd9a66f1ca0951fdab4cd4c6994ee5227960a3dc3aff9
SSDEEP 96:NSHJEMu/n3YXo1ewzqLnO8oP373ErX9TxvYiapYblM+W3jsC+qN9ZLczhl/xeZLF:oJcn3Wo8LPoTUrX9TJYiaCblM+GswkhU
MD5 SHA1 SHA512 SSDEEP

Submit Download

udlaokuy.ptr

Path C:\Users\Admin\AppData\Local\Temp\udlaokuy.ptr
Size 104KB
SHA256 83c3b9f93a94f5da64929c5872be9b9af8aa821c8ebdff2a1f73c5bf1e1c99c0
MD5 041ec0f6a5ceadef0d47e65f72cb78ed
SHA1 dff47e1df3869d71b0c4040ab9433b0474f2b43c
SHA512 d80211dc73c6c7051674df76dc5c0ecf28ab31ad28c2f80dbbd3491cc5a26a4c9a14e3b34b3f5484af2140d9f02cf5cd9c54f501bff81565c1d7a152dddcfe29
SSDEEP 3072:f/oyPQG2ldKeasqfM8ML+l3XTV3896V5lD:fgyI5ldKeeM8U+9BlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1220-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads