lokibot | 2d83164d1358ec644bb36c5edd0c16e115510789fea78f6a009a5969a74cd9e9

General

Target
2fe572c4c7550b00993c0b9b344a65df.exe
Size 364KB
Sample230106-l2s29aff67
SHA256 2d83164d1358ec644bb36c5edd0c16e115510789fea78f6a009a5969a74cd9e9
MD5 2fe572c4c7550b00993c0b9b344a65df
SHA1 050979d9ebc2b777ddaf12c15b086da39f8bd472
SHA512 76b646c346070f83832afda5442e0c5b54d1c73885b14235e58aa4c2ceeed4657c8f2a78427fc963d9cf1e39dfc9336881d9855b142f7ec5c06fe118e6a3e144
SSDEEP 6144:LYa6H6UvT9XdqN3S4bEMZBR8zWZcTeYE7BEbaT:LYh6UvDO3S4rZIr67BIaT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
4172	mpwadyu.exe
1580	mpwadyu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpwadyu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	mpwadyu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mpwadyu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 1580	4172	mpwadyu.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4172	mpwadyu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	mpwadyu.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4172	2376	2fe572c4c7550b00993c0b9b344a65df.exe	81
PID 2376 wrote to memory of 4172	2376	2fe572c4c7550b00993c0b9b344a65df.exe	81
PID 2376 wrote to memory of 4172	2376	2fe572c4c7550b00993c0b9b344a65df.exe	81
PID 4172 wrote to memory of 1580	4172	mpwadyu.exe	83
PID 4172 wrote to memory of 1580	4172	mpwadyu.exe	83
PID 4172 wrote to memory of 1580	4172	mpwadyu.exe	83
PID 4172 wrote to memory of 1580	4172	mpwadyu.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mpwadyu.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	mpwadyu.exe

C:\Users\Admin\AppData\Local\Temp\2fe572c4c7550b00993c0b9b344a65df.exe
"C:\Users\Admin\AppData\Local\Temp\2fe572c4c7550b00993c0b9b344a65df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
  "C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe" C:\Users\Admin\AppData\Local\Temp\bgnjzrb.ay
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
    "C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bgnjzrb.ay

Path C:\Users\Admin\AppData\Local\Temp\bgnjzrb.ay
Size 5KB
SHA256 ae09cd6924743d1f6ea6d7e0ec9ffd92b346f664cc765f8054a05fe2ec6f29e1
MD5 bfe6a7bf6db6b0a217ab6b863b26def6
SHA1 54fc254bc67295060e4c186a46f554746c5f09c0
SHA512 a37f8bb2eea6679cb025ee4fa8cda2400a5f5953a79a02eff0f86a4462dc8782aa9231767439101564c32a04be80860cdeb566926d5027f94d166d3fb04a87b2
SSDEEP 96:Farc6oYXg/DrYuDk2XO5oSwY0t7wVd7JKodXmnrdIqkwKOV8CxRrMX81DJi6p:FarcRLrhX1S9R37MAWnZBkwcxs1D7
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpwadyu.exe

Path C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
Size 56KB
SHA256 d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01
MD5 835ae49428df3d8aba1ac0929e8aecbc
SHA1 627074d0fd70c678c1acea4475ac4728f063a39c
SHA512 0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64
SSDEEP 768:FD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvYMtoh+WEX5:XfyeKU1Uv+NJLmYg0BlWHuC5fo25
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpwadyu.exe

Path C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
Size 56KB
SHA256 d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01
MD5 835ae49428df3d8aba1ac0929e8aecbc
SHA1 627074d0fd70c678c1acea4475ac4728f063a39c
SHA512 0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64
SSDEEP 768:FD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvYMtoh+WEX5:XfyeKU1Uv+NJLmYg0BlWHuC5fo25
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpwadyu.exe

Path C:\Users\Admin\AppData\Local\Temp\mpwadyu.exe
Size 56KB
SHA256 d92ef163cff223890ca17b02cf23826065f5e27931193aab87909ee5eb625e01
MD5 835ae49428df3d8aba1ac0929e8aecbc
SHA1 627074d0fd70c678c1acea4475ac4728f063a39c
SHA512 0d0a5c3202048e057e77be934272f1a2604d5db7033c3101ef93f2f3803b580e2a14ebfd16768437c5e3f300183ba9c81fd6eeb1c19d6915b3983518c5cede64
SSDEEP 768:FD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvYMtoh+WEX5:XfyeKU1Uv+NJLmYg0BlWHuC5fo25
MD5 SHA1 SHA512 SSDEEP

Submit Download

teongfya.mr

Path C:\Users\Admin\AppData\Local\Temp\teongfya.mr
Size 124KB
SHA256 e7beec18b26e250d6367590103ee6fe9e8aa01f6575218c650275290b2f0183e
MD5 3a3d54b6ad740fa98c312fd294ab59da
SHA1 56620da62839c6a1048b79d6311dfe5dc6215b73
SHA512 dd8b1695de33d82caeb5188f10a75290c4159237ed809f29aba2060cf19d47f724853fdeb1850c42f1200f6b9d18e4535dc5420c62f611758bebf02eecdb90b2
SSDEEP 3072:GC3VJqEgrV+Xi373wrkyT44w1mLS8g+/GGv:GaVJtE0XiLRY5wCdgAHv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1580-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1580-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads