lokibot | 8cf5acb58e1cff07fa0279f116cf73a1f288aa186c138677c35a6baeffca0a83

General

Target
11f406b1ef314cca6060886c952bedb0.exe
Size 179KB
Sample230213-tk7s3sed45
SHA256 8cf5acb58e1cff07fa0279f116cf73a1f288aa186c138677c35a6baeffca0a83
MD5 11f406b1ef314cca6060886c952bedb0
SHA1 e7d789623a9d64af4c871ee065c3136b254f7d01
SHA512 8cf494e607cdebd07361f2811221296d443e3994e65c8ce6f467657f32c02eea3b1c1074a566ed7b2e0772e009c8ed310f151edef9546b71546014bd42a4b6ca
SSDEEP 3072:XfY/TU9fE9PEtu1b23dstUs3KMvIcxBoMF/gPqYjFoIIW1Pm9QydgJzb3XBDE:PYa6L23dAwcwYgiYjFoIILuyyJfxQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.85/davidhill/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
2144	pbizpmec.exe
5040	pbizpmec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pbizpmec.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	pbizpmec.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	pbizpmec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 5040	2144	pbizpmec.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2144	pbizpmec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	pbizpmec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2144	5048	11f406b1ef314cca6060886c952bedb0.exe	80
PID 5048 wrote to memory of 2144	5048	11f406b1ef314cca6060886c952bedb0.exe	80
PID 5048 wrote to memory of 2144	5048	11f406b1ef314cca6060886c952bedb0.exe	80
PID 2144 wrote to memory of 5040	2144	pbizpmec.exe	81
PID 2144 wrote to memory of 5040	2144	pbizpmec.exe	81
PID 2144 wrote to memory of 5040	2144	pbizpmec.exe	81
PID 2144 wrote to memory of 5040	2144	pbizpmec.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	pbizpmec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pbizpmec.exe

C:\Users\Admin\AppData\Local\Temp\11f406b1ef314cca6060886c952bedb0.exe
"C:\Users\Admin\AppData\Local\Temp\11f406b1ef314cca6060886c952bedb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe
  "C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe" C:\Users\Admin\AppData\Local\Temp\baqbsaydvp.t
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe
    "C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

baqbsaydvp.t

Path C:\Users\Admin\AppData\Local\Temp\baqbsaydvp.t
Size 5KB
SHA256 b2fa66c8535d72d4f1134d9c8bdd7f483eeed325d67338821ecf97ea2ff463a0
MD5 3c45b2862d495e989d4580aef08841ea
SHA1 bc319682252c89ab0f352b59cf7af45a081824cb
SHA512 36dfe1d9320f929ceb42cf6d8395363614ea273f41c5508bc3b5394fe86ddc172c45803a6000da61654d1a77e218fcd7acc3ff8188eb152af9b14825ff2e90ca
SSDEEP 96:Farc6oY6g/DrYuQk2XO5oSwQGFpZFdgvZ+U2iLGFNZK7zmzuZP+ed:FarcR6YhX1S1GFpZngvZ+U2dFrdzSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

pbizpmec.exe

Path C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe
Size 74KB
SHA256 55b1bfb2836140f7373957c67594228ceb5728dfbeedeb1393a99c7e9d6cf9ad
MD5 a258e2f79497710f73675324b13ef40e
SHA1 fb0bad0e0e8bc630240a8e92cd1af54f96608188
SHA512 09febcfa354de3854747f99e44c1c486ad3ae4aaa2a0ab0469f9d03ab18e01232644fd428a8159a1557fa1f3559e72c1fa5d3885dd5d25c9567a989b80161717
SSDEEP 768:617omFXzGOhRMJF5sTyxuObqALUPOqImNtMrG3xbYVwHEFE6wRTqiXbtjQM/Jn8T:bcjGbFGyxuwLXqRxvkIZQSFb90MEsxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

pbizpmec.exe

Path C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe
Size 74KB
SHA256 55b1bfb2836140f7373957c67594228ceb5728dfbeedeb1393a99c7e9d6cf9ad
MD5 a258e2f79497710f73675324b13ef40e
SHA1 fb0bad0e0e8bc630240a8e92cd1af54f96608188
SHA512 09febcfa354de3854747f99e44c1c486ad3ae4aaa2a0ab0469f9d03ab18e01232644fd428a8159a1557fa1f3559e72c1fa5d3885dd5d25c9567a989b80161717
SSDEEP 768:617omFXzGOhRMJF5sTyxuObqALUPOqImNtMrG3xbYVwHEFE6wRTqiXbtjQM/Jn8T:bcjGbFGyxuwLXqRxvkIZQSFb90MEsxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

pbizpmec.exe

Path C:\Users\Admin\AppData\Local\Temp\pbizpmec.exe
Size 74KB
SHA256 55b1bfb2836140f7373957c67594228ceb5728dfbeedeb1393a99c7e9d6cf9ad
MD5 a258e2f79497710f73675324b13ef40e
SHA1 fb0bad0e0e8bc630240a8e92cd1af54f96608188
SHA512 09febcfa354de3854747f99e44c1c486ad3ae4aaa2a0ab0469f9d03ab18e01232644fd428a8159a1557fa1f3559e72c1fa5d3885dd5d25c9567a989b80161717
SSDEEP 768:617omFXzGOhRMJF5sTyxuObqALUPOqImNtMrG3xbYVwHEFE6wRTqiXbtjQM/Jn8T:bcjGbFGyxuwLXqRxvkIZQSFb90MEsxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

wkjjrdsslmh.tz

Path C:\Users\Admin\AppData\Local\Temp\wkjjrdsslmh.tz
Size 124KB
SHA256 b639140c43bcb58b66f2b745aee7d66032a6115943e5c307193ccc78fbd50274
MD5 54c6a6b406015d94f31f3c1cca62efdd
SHA1 c183140dc7ffdf8e3798a697e3259b0290632681
SHA512 475fe467ce7d4485ba2c8caf11a7ca37e06fd0f23b2f2f11a9384783721698172b563cb2e446eef208383fa8e20a9aba0087cd38bf3b00da0ded7a7b52d351e5
SSDEEP 3072:dIg2AVuKB2EPh+vAbaEME97yPBaX7oubd1IQqolCvesEmvP88K7dN:dI2Vu6ZPhqEMEMaou3IQqolC28vk8KP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5040-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/5040-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads