lokibot | 124c7e9b3f1e0b7875e4b45594a983bfe1eaa1fdf358b4b8af141bba16f40137

General

Target
SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe
Size 136KB
Sample221130-e3nqlaba4t
SHA256 124c7e9b3f1e0b7875e4b45594a983bfe1eaa1fdf358b4b8af141bba16f40137
MD5 3814fd9b9097822e631a3515a82dbdcb
SHA1 6ba5813f9b70c61fe694fe219906bf63af2a0afb
SHA512 564a07a28617b82e7985c8d783c309680ea7181d6db9d37a9a162bf2e34f4eaae804a1a940c4f596d16b8c31944f3f3e34f65d18444f1471a864c4d15302f847
SSDEEP 3072:QEhKzShSycSMDC5BpzhXmrcQrI80s35cSZJOF2ElD:QBn1DwBZA2j6OgWD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/sarag/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
4892	esvcxlm.exe
4912	esvcxlm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	esvcxlm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	esvcxlm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	esvcxlm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 4912	4892	esvcxlm.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4892	esvcxlm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	esvcxlm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4892	2000	SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe	82
PID 2000 wrote to memory of 4892	2000	SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe	82
PID 2000 wrote to memory of 4892	2000	SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe	82
PID 4892 wrote to memory of 4912	4892	esvcxlm.exe	83
PID 4892 wrote to memory of 4912	4892	esvcxlm.exe	83
PID 4892 wrote to memory of 4912	4892	esvcxlm.exe	83
PID 4892 wrote to memory of 4912	4892	esvcxlm.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	esvcxlm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	esvcxlm.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.24623.25818.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe
  "C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe" C:\Users\Admin\AppData\Local\Temp\rutrvdgfllc.sw
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe
    "C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe" C:\Users\Admin\AppData\Local\Temp\rutrvdgfllc.sw
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

esvcxlm.exe

Path C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe
Size 58KB
SHA256 a15286dfda1645f03a85b3131f190969b5d4b640984081a1e43e1e8c277765a8
MD5 0d9b2f69eac4b7639948943276db58d5
SHA1 e1cc25f15439d18a6253d92eac15916d536382c3
SHA512 0a095cef5eef439c37e278bc09beed0f348b22372e2c2d2dadeab8960a0112c22ba6a6adc2f51b1c38c2665b403ff92f2aa19237460d71444e4cd0d8fc1a08b1
SSDEEP 1536:SgOaS+McPL3LPVWkaQ+nJXwj1yJ4c1ct3P85C6W:5ZPL3LPVWkaQ+n21ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

esvcxlm.exe

Path C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe
Size 58KB
SHA256 a15286dfda1645f03a85b3131f190969b5d4b640984081a1e43e1e8c277765a8
MD5 0d9b2f69eac4b7639948943276db58d5
SHA1 e1cc25f15439d18a6253d92eac15916d536382c3
SHA512 0a095cef5eef439c37e278bc09beed0f348b22372e2c2d2dadeab8960a0112c22ba6a6adc2f51b1c38c2665b403ff92f2aa19237460d71444e4cd0d8fc1a08b1
SSDEEP 1536:SgOaS+McPL3LPVWkaQ+nJXwj1yJ4c1ct3P85C6W:5ZPL3LPVWkaQ+n21ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

esvcxlm.exe

Path C:\Users\Admin\AppData\Local\Temp\esvcxlm.exe
Size 58KB
SHA256 a15286dfda1645f03a85b3131f190969b5d4b640984081a1e43e1e8c277765a8
MD5 0d9b2f69eac4b7639948943276db58d5
SHA1 e1cc25f15439d18a6253d92eac15916d536382c3
SHA512 0a095cef5eef439c37e278bc09beed0f348b22372e2c2d2dadeab8960a0112c22ba6a6adc2f51b1c38c2665b403ff92f2aa19237460d71444e4cd0d8fc1a08b1
SSDEEP 1536:SgOaS+McPL3LPVWkaQ+nJXwj1yJ4c1ct3P85C6W:5ZPL3LPVWkaQ+n21ll
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutrvdgfllc.sw

Path C:\Users\Admin\AppData\Local\Temp\rutrvdgfllc.sw
Size 5KB
SHA256 5884d97b5e822b17e49440389543af75c6efa30573788c26070248c30e987f68
MD5 86e13e617f187c6655c4e50216053ec3
SHA1 a259aadcd92a2acbced9927cdfa7538154fa4cd2
SHA512 497ef4490e38a9a5df72fe3f5a449bc6a9d14606c6ec9f59dd048c20f24dd6e310e975cd6ba6fb4da15669bdcd5a07bb7ac4bdd36ddb03af157d1cfc8dee2ad1
SSDEEP 96:jJ9PpdcCTd0M/vn+/rXsaAZhGP+QbhkIuL9krWeXtF9EkAAaZBiQB:Hpd4on+TXsDYVuL9OWI6kbD6
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmcngnzf.mgv

Path C:\Users\Admin\AppData\Local\Temp\xmcngnzf.mgv
Size 104KB
SHA256 d5758fdecb6e72bce5817c3ad8e18f92f8eb8799d275b3e4fedf1399324a2939
MD5 6eba6bb8633206eeaa4ad06d693b38ce
SHA1 d312294eb875e4b48b6edb93f8f13a6655298ae9
SHA512 97a6a672264bbe7fa5d5d0de5c843b9248598a1d51bfe55ad116d7b729d3c6cf394d3e0df3b60c7f962cff17b8fb828359ea88bfef20c64f6adff99b82ea02ba
SSDEEP 1536:suPMrseRvDzqR5iK1KfhUw2uktCn+X1T0/ocH1xYvCeDvNx3XwLvo:suPjeJXy1BGktCn+X14/JXYvZDv7Xgvo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4912-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4912-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads