lokibot | 2d83164d1358ec644bb36c5edd0c16e115510789fea78f6a009a5969a74cd9e9

General

Target

2fe572c4c7550b00993c0b9b344a65df.exe
Size

364KB
MD5

2fe572c4c7550b00993c0b9b344a65df
SHA1

050979d9ebc2b777ddaf12c15b086da39f8bd472
SHA256

2d83164d1358ec644bb36c5edd0c16e115510789fea78f6a009a5969a74cd9e9
SHA512

76b646c346070f83832afda5442e0c5b54d1c73885b14235e58aa4c2ceeed4657c8f2a78427fc963d9cf1e39dfc9336881d9855b142f7ec5c06fe118e6a3e144
SSDEEP

6144:LYa6H6UvT9XdqN3S4bEMZBR8zWZcTeYE7BEbaT:LYh6UvDO3S4rZIr67BIaT

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
980	mpwadyu.exe
1724	mpwadyu.exe

Loads dropped DLL 3 IoCs

pid	Process
1124	2fe572c4c7550b00993c0b9b344a65df.exe
1124	2fe572c4c7550b00993c0b9b344a65df.exe
980	mpwadyu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mpwadyu.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpwadyu.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	mpwadyu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 980 set thread context of 1724	980	mpwadyu.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
980	mpwadyu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	mpwadyu.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 980	1124	2fe572c4c7550b00993c0b9b344a65df.exe	27
PID 1124 wrote to memory of 980	1124	2fe572c4c7550b00993c0b9b344a65df.exe	27
PID 1124 wrote to memory of 980	1124	2fe572c4c7550b00993c0b9b344a65df.exe	27
PID 1124 wrote to memory of 980	1124	2fe572c4c7550b00993c0b9b344a65df.exe	27
PID 980 wrote to memory of 1724	980	mpwadyu.exe	29
PID 980 wrote to memory of 1724	980	mpwadyu.exe	29
PID 980 wrote to memory of 1724	980	mpwadyu.exe	29
PID 980 wrote to memory of 1724	980	mpwadyu.exe	29
PID 980 wrote to memory of 1724	980	mpwadyu.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mpwadyu.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpwadyu.exe

C:\Users\Admin\AppData\Local\Temp\2fe572c4c7550b00993c0b9b344a65df.exe
"C:\Users\Admin\AppData\Local\Temp\2fe572c4c7550b00993c0b9b344a65df.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
  "C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe" C:\Users\Admin\AppData\Local\Temp\bgnjzrb.ay
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
    "C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bgnjzrb.ay

Filesize
5KB

MD5
bfe6a7bf6db6b0a217ab6b863b26def6

SHA1
54fc254bc67295060e4c186a46f554746c5f09c0

SHA256
ae09cd6924743d1f6ea6d7e0ec9ffd92b346f664cc765f8054a05fe2ec6f29e1

SHA512
a37f8bb2eea6679cb025ee4fa8cda2400a5f5953a79a02eff0f86a4462dc8782aa9231767439101564c32a04be80860cdeb566926d5027f94d166d3fb04a87b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
C:\Users\Admin\AppData\Local\Temp\teongfya.mr

Filesize
124KB

MD5
3a3d54b6ad740fa98c312fd294ab59da

SHA1
56620da62839c6a1048b79d6311dfe5dc6215b73

SHA256
e7beec18b26e250d6367590103ee6fe9e8aa01f6575218c650275290b2f0183e

SHA512
dd8b1695de33d82caeb5188f10a75290c4159237ed809f29aba2060cf19d47f724853fdeb1850c42f1200f6b9d18e4535dc5420c62f611758bebf02eecdb90b2

Download Submit
\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
\Users\Admin\AppData\Local\Temp\mpwadyu.exe

Filesize
56KB

MD5
835ae49428df3d8aba1ac0929e8aecbc

SHA1
627074d0fd70c678c1acea4475ac4728f063a39c

SHA256
d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01

SHA512
0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64

Download Submit
memory/1124-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1724-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1724-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing