lokibot | adc6a50e5985c31f0ed5ea885edd73e787f893f709591e5cf795fd78403d1430

General

Target

58dbd12561b26a53ecf30b37a0c4060d.exe
Size

354KB
MD5

58dbd12561b26a53ecf30b37a0c4060d
SHA1

3e1c7d108c4d672b2bf226727485a163a8fa70a9
SHA256

adc6a50e5985c31f0ed5ea885edd73e787f893f709591e5cf795fd78403d1430
SHA512

d83112639e95ea70a98dadb4d6875536380c45baec9d6b4dd00dd0b7d9dee8a1e68611fdd43820d5f0cca9591a47a2e5fa7d0f56e5b4d80d286f37e0d311d92d
SSDEEP

6144:AYa6qmngd6pKEHki5EtBR0cKIM+oyVKFzqQPtglr6y3WUSIQxlBzQJ:AYbgd63Ei5EtYcKIM+Xk3gQy3rSIQV0

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Executes dropped EXE 2 IoCs

Processes:

griomhv.exegriomhv.exe

pid process

1768 griomhv.exe
1988 griomhv.exe
Loads dropped DLL 3 IoCs

Processes:

58dbd12561b26a53ecf30b37a0c4060d.exegriomhv.exe

pid process

860 58dbd12561b26a53ecf30b37a0c4060d.exe
860 58dbd12561b26a53ecf30b37a0c4060d.exe
1768 griomhv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1768	griomhv.exe
1988	griomhv.exe

pid	process
860	58dbd12561b26a53ecf30b37a0c4060d.exe
860	58dbd12561b26a53ecf30b37a0c4060d.exe
1768	griomhv.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

griomhv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	griomhv.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	griomhv.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	griomhv.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

griomhv.exe

description pid process target process

PID 1768 set thread context of 1988 1768 griomhv.exe griomhv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

griomhv.exe

pid process

1768 griomhv.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

griomhv.exe

description pid process

Token: SeDebugPrivilege 1988 griomhv.exe

description	pid	process	target process
PID 1768 set thread context of 1988	1768	griomhv.exe	griomhv.exe

pid	process
1768	griomhv.exe

description	pid	process
Token: SeDebugPrivilege	1988	griomhv.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

58dbd12561b26a53ecf30b37a0c4060d.exegriomhv.exe

description	pid	process	target process
PID 860 wrote to memory of 1768	860	58dbd12561b26a53ecf30b37a0c4060d.exe	griomhv.exe
PID 860 wrote to memory of 1768	860	58dbd12561b26a53ecf30b37a0c4060d.exe	griomhv.exe
PID 860 wrote to memory of 1768	860	58dbd12561b26a53ecf30b37a0c4060d.exe	griomhv.exe
PID 860 wrote to memory of 1768	860	58dbd12561b26a53ecf30b37a0c4060d.exe	griomhv.exe
PID 1768 wrote to memory of 1988	1768	griomhv.exe	griomhv.exe
PID 1768 wrote to memory of 1988	1768	griomhv.exe	griomhv.exe
PID 1768 wrote to memory of 1988	1768	griomhv.exe	griomhv.exe
PID 1768 wrote to memory of 1988	1768	griomhv.exe	griomhv.exe
PID 1768 wrote to memory of 1988	1768	griomhv.exe	griomhv.exe

outlook_office_path 1 IoCs

Processes:

griomhv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	griomhv.exe

outlook_win_path 1 IoCs

Processes:

griomhv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	griomhv.exe

C:\Users\Admin\AppData\Local\Temp\58dbd12561b26a53ecf30b37a0c4060d.exe
"C:\Users\Admin\AppData\Local\Temp\58dbd12561b26a53ecf30b37a0c4060d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\griomhv.exe
"C:\Users\Admin\AppData\Local\Temp\griomhv.exe" C:\Users\Admin\AppData\Local\Temp\ocezwxbaws.tnb
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\griomhv.exe
"C:\Users\Admin\AppData\Local\Temp\griomhv.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
C:\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
C:\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
C:\Users\Admin\AppData\Local\Temp\ocezwxbaws.tnb
Filesize
5KB

MD5
736c032772b93b60ae1e2067052cadb1

SHA1
a7e78bc73ce87b809a3d37653f1922720b183114

SHA256
d4ee48c3fafdea592df4f1de273497e2a15e0a86fa45d5608f61f6d764049ccd

SHA512
ba175ed6e56513877d0ba31e38e351927319d5db57ddaeb52b960b55660cf6414af5b1c19cf059eb3048b0e080f3b0bdb8abedd61c96a02552d5980f326d4b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\ulamxtxdx.dn
Filesize
124KB

MD5
22286bcaafac73cc45e5d1cf19945c42

SHA1
b6b687b63da60b27a08547ab631b98496e00319f

SHA256
6b0abe65ad494fd2a39e1ed8799e60a45e3ebeb72136adca4eeeb575ec897c1e

SHA512
c16ff1af55bbde8bd07c7d252595c7778fe97284d9927ea5b441e4aef4e31df3f23187c501f22d8a294bbe21422a1715363b026eb41fff7a1a5b3d67f0412f7c

Download Submit
\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
\Users\Admin\AppData\Local\Temp\griomhv.exe
Filesize
50KB

MD5
1e615c9c0c88c482c37312c4d4dd21ad

SHA1
d39ff54b50c39a65aab93ba6c2f0973352acc17c

SHA256
f95916898fe7344320b8b8e48ed7a02ec4b4093772be338da5dd3d4ba4326397

SHA512
c179195f66f889fd9467deffb10d4cc32e12c3d121079a173d991549bb43cce096892c13892cf25be4e0c0c1545c1d0f3d2eabdaeb38ed5bec9664b363236496

Download Submit
memory/860-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000000000000-mapping.dmp

Download
memory/1988-64-0x00000000004139DE-mapping.dmp

Download
memory/1988-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1988-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads