lokibot | 3d099ea41ca7b6d89c4a5f50abc43e65310c0f306bd18ec4915e1acf193d2117

General

Target
f40f44f01175541ccf44f0c9064487b4.exe
Size 366KB
Sample230120-kpv6eaac89
SHA256 3d099ea41ca7b6d89c4a5f50abc43e65310c0f306bd18ec4915e1acf193d2117
MD5 f40f44f01175541ccf44f0c9064487b4
SHA1 6d80e10fe597301fbfcbad33822db6a5a018a4e9
SHA512 2dade5e729c35888ec9f921a515bdaba935e27090a3acfc137369414d9d3982fa33f87faea258405b91d134f47b04ecac010f7ca1fb61aeadda45d88a33de3ca
SSDEEP 6144:dYa67n4jNXF3tNwqjaeGbBfO6t7epArnuuaCDXqwUjijv:dYebdNweGlO65trnuuVDXtbjv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1996	uzekiwur.exe
5016	uzekiwur.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uzekiwur.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	uzekiwur.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uzekiwur.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 5016	1996	uzekiwur.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1996	uzekiwur.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	uzekiwur.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1996	4372	f40f44f01175541ccf44f0c9064487b4.exe	79
PID 4372 wrote to memory of 1996	4372	f40f44f01175541ccf44f0c9064487b4.exe	79
PID 4372 wrote to memory of 1996	4372	f40f44f01175541ccf44f0c9064487b4.exe	79
PID 1996 wrote to memory of 5016	1996	uzekiwur.exe	81
PID 1996 wrote to memory of 5016	1996	uzekiwur.exe	81
PID 1996 wrote to memory of 5016	1996	uzekiwur.exe	81
PID 1996 wrote to memory of 5016	1996	uzekiwur.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uzekiwur.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uzekiwur.exe

C:\Users\Admin\AppData\Local\Temp\f40f44f01175541ccf44f0c9064487b4.exe
"C:\Users\Admin\AppData\Local\Temp\f40f44f01175541ccf44f0c9064487b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe
  "C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe" C:\Users\Admin\AppData\Local\Temp\szhfj.sve
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe
    "C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddpbbsajx.ox

Path C:\Users\Admin\AppData\Local\Temp\ddpbbsajx.ox
Size 124KB
SHA256 77bf13b3fa2d37dfc38f3701cca182057f5e2bb8e67c6b81bfd5cbbe9d172028
MD5 54f7dc72d1271859d49d7764b084c028
SHA1 33a593b9552bd636a55563c73de0b0c099c3ad52
SHA512 728e7583169b652148fbb5f7e1076a972083fd46120fabff34f7ba1738f1fbf047fad6649d6c8199cbd566e088e524517fb448916be1ab8b6309c4bc1ced425d
SSDEEP 3072:kW3AVaOalWZzZg9/6F7zQZA5B3IKJJx8HDAP4ux:FUnZlg9/a7zQq5qKJyYJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

szhfj.sve

Path C:\Users\Admin\AppData\Local\Temp\szhfj.sve
Size 6KB
SHA256 44452e05f13e4779b3b24477bfbb83ad0ea1154b6b62c353aaf4c036211f2926
MD5 94109f9a4fdc153d8b5827e485aafcc6
SHA1 362c33bb4ae14c3db9681facf12dc6b69fc6ba38
SHA512 4d6baed5627a00a3f41157104d66812b646d687ff43527ce72b2899e0df96637b71c6817e31c2dc2c6b55b729293b8e116cc85b587e22858646f2099413697f8
SSDEEP 192:FarcRNvWhX1ShpjegeoEs/goIv6SLtNI7ypzV:iKhso9oj68NI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzekiwur.exe

Path C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe
Size 46KB
SHA256 fb3bac859776a4d20d5f9939553acbe3518b4569a85a021bd1726005696a7188
MD5 97988da1696d406e8b6eda6add5c1275
SHA1 a75d89724e46ac0eb5a2759cc02f23e9663cdf7b
SHA512 a4871053437263ea26fabe20b03b3fafaa128af8e0bf88ffcc7e242936857af5c5c251aacfb6630551bb1e1a79853b32562a7e8e24086f6ad0deb6a3375c56bc
SSDEEP 768:eqkzN3Z6TUBq13f/j+mbwGqni+td9O4+yhdZchl4rydncfPxSEDKAnzxbeex:eF1Z6Yg13fi6Jqni+sHyKS4cfPvzNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzekiwur.exe

Path C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe
Size 46KB
SHA256 fb3bac859776a4d20d5f9939553acbe3518b4569a85a021bd1726005696a7188
MD5 97988da1696d406e8b6eda6add5c1275
SHA1 a75d89724e46ac0eb5a2759cc02f23e9663cdf7b
SHA512 a4871053437263ea26fabe20b03b3fafaa128af8e0bf88ffcc7e242936857af5c5c251aacfb6630551bb1e1a79853b32562a7e8e24086f6ad0deb6a3375c56bc
SSDEEP 768:eqkzN3Z6TUBq13f/j+mbwGqni+td9O4+yhdZchl4rydncfPxSEDKAnzxbeex:eF1Z6Yg13fi6Jqni+sHyKS4cfPvzNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzekiwur.exe

Path C:\Users\Admin\AppData\Local\Temp\uzekiwur.exe
Size 46KB
SHA256 fb3bac859776a4d20d5f9939553acbe3518b4569a85a021bd1726005696a7188
MD5 97988da1696d406e8b6eda6add5c1275
SHA1 a75d89724e46ac0eb5a2759cc02f23e9663cdf7b
SHA512 a4871053437263ea26fabe20b03b3fafaa128af8e0bf88ffcc7e242936857af5c5c251aacfb6630551bb1e1a79853b32562a7e8e24086f6ad0deb6a3375c56bc
SSDEEP 768:eqkzN3Z6TUBq13f/j+mbwGqni+td9O4+yhdZchl4rydncfPxSEDKAnzxbeex:eF1Z6Yg13fi6Jqni+sHyKS4cfPvzNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5016-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5016-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads