lokibot | ce66d8963808e8a84fb85edd8b2850099ae240eab88f2a98413efd01e40922b1

General

Target

fb4f4746d44d1ae472506334dacf6956.exe
Size

201KB
MD5

fb4f4746d44d1ae472506334dacf6956
SHA1

44c44fae4e3007fa8636e9108dd8070ce7ab7a07
SHA256

ce66d8963808e8a84fb85edd8b2850099ae240eab88f2a98413efd01e40922b1
SHA512

be971f9a181b5a7bd9efbe47a160a0eda5b981f871eede2aacd872a00940f082487ae1704249494bd78f5ae616e013afb11098ec89055acdd26b1a12996d3a11
SSDEEP

3072:HfY/TU9fE9PEtu4beIkBZHFfUqayG/s3ABV0IOFVhEpvC402Dp+bocVKtww7l7:/Ya6EefvHp17G/b/kEd0s4o2KN7l7

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha25/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Executes dropped EXE 2 IoCs

Processes:

awdaoqo.exeawdaoqo.exe

pid process

1464 awdaoqo.exe
1248 awdaoqo.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1464	awdaoqo.exe
1248	awdaoqo.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

awdaoqo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	awdaoqo.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	awdaoqo.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	awdaoqo.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

awdaoqo.exe

description pid process target process

PID 1464 set thread context of 1248 1464 awdaoqo.exe awdaoqo.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

awdaoqo.exe

pid process

1464 awdaoqo.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

awdaoqo.exe

description pid process

Token: SeDebugPrivilege 1248 awdaoqo.exe

description	pid	process	target process
PID 1464 set thread context of 1248	1464	awdaoqo.exe	awdaoqo.exe

pid	process
1464	awdaoqo.exe

description	pid	process
Token: SeDebugPrivilege	1248	awdaoqo.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fb4f4746d44d1ae472506334dacf6956.exeawdaoqo.exe

description	pid	process	target process
PID 1092 wrote to memory of 1464	1092	fb4f4746d44d1ae472506334dacf6956.exe	awdaoqo.exe
PID 1092 wrote to memory of 1464	1092	fb4f4746d44d1ae472506334dacf6956.exe	awdaoqo.exe
PID 1092 wrote to memory of 1464	1092	fb4f4746d44d1ae472506334dacf6956.exe	awdaoqo.exe
PID 1464 wrote to memory of 1248	1464	awdaoqo.exe	awdaoqo.exe
PID 1464 wrote to memory of 1248	1464	awdaoqo.exe	awdaoqo.exe
PID 1464 wrote to memory of 1248	1464	awdaoqo.exe	awdaoqo.exe
PID 1464 wrote to memory of 1248	1464	awdaoqo.exe	awdaoqo.exe

outlook_office_path 1 IoCs

Processes:

awdaoqo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	awdaoqo.exe

outlook_win_path 1 IoCs

Processes:

awdaoqo.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	awdaoqo.exe

C:\Users\Admin\AppData\Local\Temp\fb4f4746d44d1ae472506334dacf6956.exe
"C:\Users\Admin\AppData\Local\Temp\fb4f4746d44d1ae472506334dacf6956.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe
"C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe" C:\Users\Admin\AppData\Local\Temp\fgpjmasrn.o
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe
"C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe
Filesize
138KB

MD5
046685d9d7d278fa6c44c733e6d0c2ac

SHA1
168e23588c8f1007db38ef6e16d5fd0405d79fe7

SHA256
faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456

SHA512
317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474

Download Submit
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe
Filesize
138KB

MD5
046685d9d7d278fa6c44c733e6d0c2ac

SHA1
168e23588c8f1007db38ef6e16d5fd0405d79fe7

SHA256
faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456

SHA512
317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474

Download Submit
C:\Users\Admin\AppData\Local\Temp\awdaoqo.exe
Filesize
138KB

MD5
046685d9d7d278fa6c44c733e6d0c2ac

SHA1
168e23588c8f1007db38ef6e16d5fd0405d79fe7

SHA256
faeee54269c608286b17629f1bf55427655402fc321da5ba833c16f3ef9b5456

SHA512
317d3749e443b7c24f96fb04a6961aca2148f734e956f12a76b1eaa91ee154d611c1a74e796cb75778b74accc0950b1ce684ec523cf0f21a3fc989831ef09474

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmcehbasj.h
Filesize
124KB

MD5
e5938d6946b58f3cf7dd8b27b1b0f8c0

SHA1
d7c96ac11d2e41835f77ef90aec4fbe69580c8d3

SHA256
1c2ddbccfd5050efb38f0613d18dac11690e9c793ac881170d2b06e5118c4199

SHA512
5bf347470969e077be619ab981b6924b14dce931a666b89e4dc0f0dd2935829cfc8d5de694bc7c828ec3293cc05e2435ef650f0540a1087f9bbb86b99db76f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fgpjmasrn.o
Filesize
5KB

MD5
4f37ca5aef7664f31c8ebaf3d4833d06

SHA1
51cacf7c3151948e751b955a79cec382b24f9b52

SHA256
05e6e85149f3f7e3562d9bf491d35a66cdd877f3cd8778cdd0d18f7804b05135

SHA512
c98d327f39e7c80412cd730a9ed19064f5bfd05279476db120fe273c5c59cd8db4d4c23e753b0b5c5fdd27de10c86c99e17e5cc315989aa943203f3ffd4fe55c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
memory/1248-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1248-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1248-147-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1248-166-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1248-180-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1464-140-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads