lokibot | 8b935c37e193eddd81430065706492c65d86bae340c19efcbe702fce64b65779

General

Target
cb3a7b07ab43407662629272452bb0df.exe
Size 408KB
Sample230103-hvephaaf58
SHA256 8b935c37e193eddd81430065706492c65d86bae340c19efcbe702fce64b65779
MD5 cb3a7b07ab43407662629272452bb0df
SHA1 c7c907c5c3a91c180b579e40bfe7b99245869005
SHA512 10c1a717fa80b87cf76fd04ce9550175778cd018e0373e837fc2133e4c0f8a8088606a66b2695e6f7c9a156378f3a2dce6bebcee0ef5f516f0a855c851f8ed4d
SSDEEP 12288:IY8GYCy8j3kOddAvNuRiBMduFqzEm+BJo:IYZ3kOddAvNpBM0tjbo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
5028	ckllreiw.exe
868	ckllreiw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ckllreiw.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ckllreiw.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ckllreiw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 868	5028	ckllreiw.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5028	ckllreiw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	ckllreiw.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 5028	4884	cb3a7b07ab43407662629272452bb0df.exe	80
PID 4884 wrote to memory of 5028	4884	cb3a7b07ab43407662629272452bb0df.exe	80
PID 4884 wrote to memory of 5028	4884	cb3a7b07ab43407662629272452bb0df.exe	80
PID 5028 wrote to memory of 868	5028	ckllreiw.exe	82
PID 5028 wrote to memory of 868	5028	ckllreiw.exe	82
PID 5028 wrote to memory of 868	5028	ckllreiw.exe	82
PID 5028 wrote to memory of 868	5028	ckllreiw.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ckllreiw.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ckllreiw.exe

C:\Users\Admin\AppData\Local\Temp\cb3a7b07ab43407662629272452bb0df.exe
"C:\Users\Admin\AppData\Local\Temp\cb3a7b07ab43407662629272452bb0df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe
  "C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe" C:\Users\Admin\AppData\Local\Temp\gzvzx.k
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe
    "C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ckllreiw.exe

Path C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe
Size 90KB
SHA256 b01158dd9be205c6f717c3e0f68de231bd97a341458d88b108e1d9acaf44c8c9
MD5 5ac1a13c49b1dad809e813abf06fa435
SHA1 128244867b79ab22c4226e4f542e54aa93f33bbe
SHA512 a1d751ae8b6efe345f5cb1fed24de67df6fd3004ae28d87288d0eab40aa662f1da7b96842bc2294c301eaa67be3d9ff29fc02a3d354a8a35479dd0f068119a1f
SSDEEP 1536:IeAMCjWCUEffq3X7PY6LT7pUsjB14nvKGeRc3cmacAyjCfLFSoOuLgdsWV3SNcdh:IecjWCUEf87Y6LT7pzmKRRc3cmacA/fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckllreiw.exe

Path C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe
Size 90KB
SHA256 b01158dd9be205c6f717c3e0f68de231bd97a341458d88b108e1d9acaf44c8c9
MD5 5ac1a13c49b1dad809e813abf06fa435
SHA1 128244867b79ab22c4226e4f542e54aa93f33bbe
SHA512 a1d751ae8b6efe345f5cb1fed24de67df6fd3004ae28d87288d0eab40aa662f1da7b96842bc2294c301eaa67be3d9ff29fc02a3d354a8a35479dd0f068119a1f
SSDEEP 1536:IeAMCjWCUEffq3X7PY6LT7pUsjB14nvKGeRc3cmacAyjCfLFSoOuLgdsWV3SNcdh:IecjWCUEf87Y6LT7pzmKRRc3cmacA/fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckllreiw.exe

Path C:\Users\Admin\AppData\Local\Temp\ckllreiw.exe
Size 90KB
SHA256 b01158dd9be205c6f717c3e0f68de231bd97a341458d88b108e1d9acaf44c8c9
MD5 5ac1a13c49b1dad809e813abf06fa435
SHA1 128244867b79ab22c4226e4f542e54aa93f33bbe
SHA512 a1d751ae8b6efe345f5cb1fed24de67df6fd3004ae28d87288d0eab40aa662f1da7b96842bc2294c301eaa67be3d9ff29fc02a3d354a8a35479dd0f068119a1f
SSDEEP 1536:IeAMCjWCUEffq3X7PY6LT7pUsjB14nvKGeRc3cmacAyjCfLFSoOuLgdsWV3SNcdh:IecjWCUEf87Y6LT7pzmKRRc3cmacA/fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

gzvzx.k

Path C:\Users\Admin\AppData\Local\Temp\gzvzx.k
Size 6KB
SHA256 9ec7619086c8eeaceb49dc3ea9415de77ff67e12c8f3adccf91c26ad39de3100
MD5 d40286f9d17f8e4fb873169eaf66fb40
SHA1 dcf24bbbbd14bffd6f438e46f2dbaf09cf565425
SHA512 9443b8540c23468fbf34fadaf6c1be5141a55e6be4c29623ca403df0acc4e13cac668078cde4d342ce87053f45aca4b64fcfc7caff168b2733cfda673b20f44c
SSDEEP 192:FarcR8chX1S9Oyo3TQCEwA/uFOsS4Qw1sNI:9K9mDQKA/uFXS4Xs+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwahjsf.znq

Path C:\Users\Admin\AppData\Local\Temp\pwahjsf.znq
Size 124KB
SHA256 584c99dc025bc85a22b0e0b0cfbc91faf5827a662ec283c2de294112c4583ad5
MD5 3c1fb7c976251062acd1373ac71a0609
SHA1 d2851167efd47d03facb57dd6f327b5967051a60
SHA512 82adc8af0671688c4c026c0f099cd8d1636b2a6fff968fd041dfa3f172bead09dde6a23bc1661ea676a8f22818bbef6a354b8e0acfb2298be7c5d4508d739ee4
SSDEEP 3072:0XIi/5OqTYPxCDdZDx7ZRpops5KaDe9ht7DEpPqcag285AXwIrzcTv:0X5Qqox4XdpoR2el7D6rV5qwI/cTv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/868-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/868-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads