lokibot | 12dc3dedf943f18e565b3c37f2d2eac8382fccdbd492bb710266b230bca288ae

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c3c036c3f358082785c293a4b7ceb2b.exe
Size 183KB
Sample230425-j2pnqabb5x
SHA256 12dc3dedf943f18e565b3c37f2d2eac8382fccdbd492bb710266b230bca288ae
MD5 2c3c036c3f358082785c293a4b7ceb2b
SHA1 9f47018f4b33484300fbddf1cf9dab59bac3ed58
SHA512 0abee50bbe56d0dc15473c2cea7526eaf9220a7d98cf21cbfa7d391291052ff5e9fccf834e37d5d0fb53058e30b666aa8aac86e6fb8a695990bd7f259dfebe80
SSDEEP 3072:HfY/TU9fE9PEtumb9+QOTT2fzZWyAaWL3atBtpJ6LxBm1YcNIiMaSF0DJML2:/Ya6GMQOTQpUah2S1YcPMvgJML2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://185.246.220.60/belly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
1776	ozklbum.exe
820	ozklbum.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ozklbum.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ozklbum.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ozklbum.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 820	1776	ozklbum.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1776	ozklbum.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	ozklbum.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1776	5044	2c3c036c3f358082785c293a4b7ceb2b.exe	84
PID 5044 wrote to memory of 1776	5044	2c3c036c3f358082785c293a4b7ceb2b.exe	84
PID 5044 wrote to memory of 1776	5044	2c3c036c3f358082785c293a4b7ceb2b.exe	84
PID 1776 wrote to memory of 820	1776	ozklbum.exe	85
PID 1776 wrote to memory of 820	1776	ozklbum.exe	85
PID 1776 wrote to memory of 820	1776	ozklbum.exe	85
PID 1776 wrote to memory of 820	1776	ozklbum.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ozklbum.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ozklbum.exe

C:\Users\Admin\AppData\Local\Temp\2c3c036c3f358082785c293a4b7ceb2b.exe
"C:\Users\Admin\AppData\Local\Temp\2c3c036c3f358082785c293a4b7ceb2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\ozklbum.exe
  "C:\Users\Admin\AppData\Local\Temp\ozklbum.exe" C:\Users\Admin\AppData\Local\Temp\vvrxyuqahv.ah
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\ozklbum.exe
    "C:\Users\Admin\AppData\Local\Temp\ozklbum.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ozklbum.exe

Path C:\Users\Admin\AppData\Local\Temp\ozklbum.exe
Size 84KB
SHA256 e30bf5a52d51006482c87233cce2bc5f617cde3444703893c68de73502fe8ef9
MD5 49e57c417f2b6a02f62149a291df2edb
SHA1 847ddc963ccfd61326b0464fcce84b7c803581bf
SHA512 a6aa9d76b76c4c8ab18c5e892b70e7cdd6081a2756f0cf9231921b62b8508a5b7eea05f134fb50b96b804cd74922462fa2adc9e77fac6b42dec13f11e26ab654
SSDEEP 1536:t0L02677+Yx/TmuQXDcOyPOv/6grXgmvtSWi8c64azMmUZcefFrb3pUsWlcdH03r:tiYh/0yPC/6ASWi8sazMNpbppH0C0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ozklbum.exe

Path C:\Users\Admin\AppData\Local\Temp\ozklbum.exe
Size 84KB
SHA256 e30bf5a52d51006482c87233cce2bc5f617cde3444703893c68de73502fe8ef9
MD5 49e57c417f2b6a02f62149a291df2edb
SHA1 847ddc963ccfd61326b0464fcce84b7c803581bf
SHA512 a6aa9d76b76c4c8ab18c5e892b70e7cdd6081a2756f0cf9231921b62b8508a5b7eea05f134fb50b96b804cd74922462fa2adc9e77fac6b42dec13f11e26ab654
SSDEEP 1536:t0L02677+Yx/TmuQXDcOyPOv/6grXgmvtSWi8c64azMmUZcefFrb3pUsWlcdH03r:tiYh/0yPC/6ASWi8sazMNpbppH0C0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ozklbum.exe

Path C:\Users\Admin\AppData\Local\Temp\ozklbum.exe
Size 84KB
SHA256 e30bf5a52d51006482c87233cce2bc5f617cde3444703893c68de73502fe8ef9
MD5 49e57c417f2b6a02f62149a291df2edb
SHA1 847ddc963ccfd61326b0464fcce84b7c803581bf
SHA512 a6aa9d76b76c4c8ab18c5e892b70e7cdd6081a2756f0cf9231921b62b8508a5b7eea05f134fb50b96b804cd74922462fa2adc9e77fac6b42dec13f11e26ab654
SSDEEP 1536:t0L02677+Yx/TmuQXDcOyPOv/6grXgmvtSWi8c64azMmUZcefFrb3pUsWlcdH03r:tiYh/0yPC/6ASWi8sazMNpbppH0C0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vvrxyuqahv.ah

Path C:\Users\Admin\AppData\Local\Temp\vvrxyuqahv.ah
Size 5KB
SHA256 8aaafa158fda75f20c74a983de490fc8dbb293b2e2b3d2d5d53f69af72f9898c
MD5 96a27fbbc9caf75e3b8f5a2bfbd205e5
SHA1 cfee52246d4dc4afb075624ed1b5eaa48414196b
SHA512 75e8004c728881c3cbc4c5bf5e9130bbc6e96d7f4b32f94fc0b5e22d1700946dde0a68a39b93da826d2265cbba6f2fbf2662dce09daa77fe2f259454cba40cbf
SSDEEP 96:Farc6oYbg/DrYu+6k2XO5oSwsr89cW1u+d/Yd/xdrBCKryiHGneZN7zmzuZPJed:FarcRLThX1ShrhCui/w/blJryxnAUzS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

wzrzzdyzr.gof

Path C:\Users\Admin\AppData\Local\Temp\wzrzzdyzr.gof
Size 124KB
SHA256 47bbda3916c6c365cb1aeb5e5181c1d94fcb7001e223ed8ee4b8da189197e0fd
MD5 b2229bcf2911006bd88f97f98309a919
SHA1 b20c6e3778b6d419814774ba4bfa05fc6180265c
SHA512 bd9bafe9c02c4242103e99bbb95579642affeaaddfda0e2ad91ededfd264e0c701f4696ba141414854abb2d47642016239acc7d5a68bfb17d86557c48a1231f8
SSDEEP 3072:LucsAM8Pi4vNU8YFKNRS24RwqyD1M2siNLpp75Lfl:gbKie6HFKNRS24qqhiN7hfl
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_8d6935fa-0795-4a6f-bfd9-e755f1917fa0

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1675742406-747946869-1029867430-1000\0f5007522459c86e95ffcc62f32308f1_8d6935fa-0795-4a6f-bfd9-e755f1917fa0
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_8d6935fa-0795-4a6f-bfd9-e755f1917fa0

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1675742406-747946869-1029867430-1000\0f5007522459c86e95ffcc62f32308f1_8d6935fa-0795-4a6f-bfd9-e755f1917fa0
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

memory/820-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/820-144-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/820-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/820-165-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/820-179-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads