lokibot | cf0e1a66f5e4e2277f8860afbc082395b7a3d452d24eeb0631c8f34dae047a45

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/12/2022, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
additional order_pdf.exe
Size 357KB
Sample221214-red8gada2t
SHA256 cf0e1a66f5e4e2277f8860afbc082395b7a3d452d24eeb0631c8f34dae047a45
MD5 b6e8a1cedb6c4c352c40965041a70b0c
SHA1 c05f0d0be379aec2db64f44f8d13cb9233186c97
SHA512 1313547458669c097d4d2477dd1187122a0141c293f86fd447a18d69aaf78258dcf1a1661321b6a99b910894d40c322271ba8a656ad6e150883b76bb69a3bc87
SSDEEP 6144:vEbMnl6tA5xFHr3nh9MpO4pvs1j2orO3wQpzz:55rr3nh9MRCj2m6pn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://drinz.us/FILAZ/QU/coosaza.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1316	nrhgnuqmx.exe
1092	nrhgnuqmx.exe

Loads dropped DLL 2 IoCs

pid	Process
1760	additional order_pdf.exe
1316	nrhgnuqmx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nrhgnuqmx.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nrhgnuqmx.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	nrhgnuqmx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 1092	1316	nrhgnuqmx.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1316	nrhgnuqmx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	nrhgnuqmx.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1316	1760	additional order_pdf.exe	27
PID 1760 wrote to memory of 1316	1760	additional order_pdf.exe	27
PID 1760 wrote to memory of 1316	1760	additional order_pdf.exe	27
PID 1760 wrote to memory of 1316	1760	additional order_pdf.exe	27
PID 1316 wrote to memory of 1092	1316	nrhgnuqmx.exe	28
PID 1316 wrote to memory of 1092	1316	nrhgnuqmx.exe	28
PID 1316 wrote to memory of 1092	1316	nrhgnuqmx.exe	28
PID 1316 wrote to memory of 1092	1316	nrhgnuqmx.exe	28
PID 1316 wrote to memory of 1092	1316	nrhgnuqmx.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nrhgnuqmx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nrhgnuqmx.exe

C:\Users\Admin\AppData\Local\Temp\additional order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\additional order_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
  "C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe" C:\Users\Admin\AppData\Local\Temp\lypdu.c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
    "C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kjgszdryhvx.wq

Path C:\Users\Admin\AppData\Local\Temp\kjgszdryhvx.wq
Size 104KB
SHA256 3dc201b17f5ef464d8c9a5c48b17910b5bd6da0c7a59c9c48fe7c8a16b8d8bc7
MD5 136e7e62937697f074a8b713d97a82b9
SHA1 cba46d685f61e4101321e6dd437f248840843782
SHA512 c588968bfb32342bc08c7bf56ad4d810aa19285af5eb8f2fd523d9be9a2a60d00dab21cb0566987573e3dfee22b62b6a84af8510156c57e3cbf369e3ec4faf5d
SSDEEP 1536:SBB6dITglfi1A1SvpKS9UycdvPqXRjKGFtZw6yscpa/BNRulcleB4ZWfcKDR8x07:yDglfqBfi98RNF1Bru54g8CjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lypdu.c

Path C:\Users\Admin\AppData\Local\Temp\lypdu.c
Size 5KB
SHA256 ec16ac9d7ec56ec40f9d5f291ebc29815568602584a10b05151c0a4ef5cc0f74
MD5 bcc6bfbef2804d6e5752ee1d01e77365
SHA1 01865a22735d8cbff005169fe2c444c37cf45d7d
SHA512 fc9bdaa939815d8279d83284265fb948539180f4cbcf83986ac32244f60f34190871d3e50d7d1a48ba822c08bf2b5beeb5ec504284635ef09d022bd488e1522d
SSDEEP 96:8d4dFrz/dGgbqyBclYk2BUCufUHzPHCiB1JdxlI9a3hv3qDbvbiyY6:k4dpZL8P2BNufwz7Ldxlwa3h/qriL6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrhgnuqmx.exe

Path C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
Size 52KB
SHA256 887815414a5356a9e964f1003204a30abac65ea696bb08f2ee45f2d02f213110
MD5 de7a3216b5754c44769db944bf6d07fd
SHA1 0edc188390729474bd6fe6fd08ed400d9dee656a
SHA512 a856487c276564aca3a5918910abe0c7eb5c229862d2a1d3d7cd617a257cd8b4f2a4b779d4c8b91369f63d6aa236f009c3bab02477964082311c937ca42d4292
SSDEEP 768:RCfoBUzuDVKaw/aRTIlAssIX4zhB4QEP1NY5BywIsi3QPE8MRcTu0a1f5LSyK6J:XM+zw/HXto1XT7k4sB0K26
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrhgnuqmx.exe

Path C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
Size 52KB
SHA256 887815414a5356a9e964f1003204a30abac65ea696bb08f2ee45f2d02f213110
MD5 de7a3216b5754c44769db944bf6d07fd
SHA1 0edc188390729474bd6fe6fd08ed400d9dee656a
SHA512 a856487c276564aca3a5918910abe0c7eb5c229862d2a1d3d7cd617a257cd8b4f2a4b779d4c8b91369f63d6aa236f009c3bab02477964082311c937ca42d4292
SSDEEP 768:RCfoBUzuDVKaw/aRTIlAssIX4zhB4QEP1NY5BywIsi3QPE8MRcTu0a1f5LSyK6J:XM+zw/HXto1XT7k4sB0K26
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrhgnuqmx.exe

Path C:\Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
Size 52KB
SHA256 887815414a5356a9e964f1003204a30abac65ea696bb08f2ee45f2d02f213110
MD5 de7a3216b5754c44769db944bf6d07fd
SHA1 0edc188390729474bd6fe6fd08ed400d9dee656a
SHA512 a856487c276564aca3a5918910abe0c7eb5c229862d2a1d3d7cd617a257cd8b4f2a4b779d4c8b91369f63d6aa236f009c3bab02477964082311c937ca42d4292
SSDEEP 768:RCfoBUzuDVKaw/aRTIlAssIX4zhB4QEP1NY5BywIsi3QPE8MRcTu0a1f5LSyK6J:XM+zw/HXto1XT7k4sB0K26
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrhgnuqmx.exe

Path \Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
Size 52KB
SHA256 887815414a5356a9e964f1003204a30abac65ea696bb08f2ee45f2d02f213110
MD5 de7a3216b5754c44769db944bf6d07fd
SHA1 0edc188390729474bd6fe6fd08ed400d9dee656a
SHA512 a856487c276564aca3a5918910abe0c7eb5c229862d2a1d3d7cd617a257cd8b4f2a4b779d4c8b91369f63d6aa236f009c3bab02477964082311c937ca42d4292
SSDEEP 768:RCfoBUzuDVKaw/aRTIlAssIX4zhB4QEP1NY5BywIsi3QPE8MRcTu0a1f5LSyK6J:XM+zw/HXto1XT7k4sB0K26
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrhgnuqmx.exe

Path \Users\Admin\AppData\Local\Temp\nrhgnuqmx.exe
Size 52KB
SHA256 887815414a5356a9e964f1003204a30abac65ea696bb08f2ee45f2d02f213110
MD5 de7a3216b5754c44769db944bf6d07fd
SHA1 0edc188390729474bd6fe6fd08ed400d9dee656a
SHA512 a856487c276564aca3a5918910abe0c7eb5c229862d2a1d3d7cd617a257cd8b4f2a4b779d4c8b91369f63d6aa236f009c3bab02477964082311c937ca42d4292
SSDEEP 768:RCfoBUzuDVKaw/aRTIlAssIX4zhB4QEP1NY5BywIsi3QPE8MRcTu0a1f5LSyK6J:XM+zw/HXto1XT7k4sB0K26
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1092-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1760-54-0x0000000075931000-0x0000000075933000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads