lokibot | ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee

General

Target

ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe
Size

163KB
MD5

b6db0b353d5148b5ec10cc58d699c106
SHA1

5ea030a1e0f7ee1aef15a514ddf915793efc6afa
SHA256

ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee
SHA512

ac45217c412516e4f1ec467329e3411800c2e729178de6771ae9cfdd735c2d0c7b26c0052c3f66bcbf507136e6c45973feba4cbbd4b8d12edb5f09096b43a160
SSDEEP

3072:HfY/TU9fE9PEtu8bQ+eRmezpZISLFfr6lLuQltZTkiHSKfC9bz8J+iuk0ap9fswW:/Ya6IQ+ezpeSRfelRlPcKfY381HJswY/

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.60/belly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
2732	nxeoaco.exe
2736	nxeoaco.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nxeoaco.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	nxeoaco.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nxeoaco.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2736	2732	nxeoaco.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2732	nxeoaco.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	nxeoaco.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2732	3040	ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe	85
PID 3040 wrote to memory of 2732	3040	ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe	85
PID 3040 wrote to memory of 2732	3040	ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe	85
PID 2732 wrote to memory of 2736	2732	nxeoaco.exe	86
PID 2732 wrote to memory of 2736	2732	nxeoaco.exe	86
PID 2732 wrote to memory of 2736	2732	nxeoaco.exe	86
PID 2732 wrote to memory of 2736	2732	nxeoaco.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	nxeoaco.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	nxeoaco.exe

C:\Users\Admin\AppData\Local\Temp\ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe
"C:\Users\Admin\AppData\Local\Temp\ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe
  "C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe" C:\Users\Admin\AppData\Local\Temp\icoimcw.jnx
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe
    "C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\icoimcw.jnx

Filesize
5KB

MD5
9925ab13dea8de85836f7850a658a4f1

SHA1
a492953ea4ce854b1a19a01c3f5f4b5e7ccd57bd

SHA256
b22caa0e0778b8da906555783106fdc755756cd3b3bea7beab39e76d2a7e16f5

SHA512
ab063bb8bef1af03df9b54b67b6548854fc79280f90bd82aa5c42a3cb2bef86059ce01769d2933e14518431fb398e3853e89842806d09e7d234af42b0b4d54ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe

Filesize
41KB

MD5
563b24aab3c8b6ded76d42fe8b31c7a6

SHA1
f05072c4caf5b38c17ad27d6099cd9c9aef689e6

SHA256
0a9178ca7ffdd4b78bfbee559c8ca458fa7efb424dcd15ca905c4909c362507d

SHA512
5dcccf42baa31a625f66237e538d6b8397b5ff34db9e7e2a462646b4fee4987075139d9622234ee67e6e4fa684cc6b5aebe0ad13242706e3203ee6b30da68a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe

Filesize
41KB

MD5
563b24aab3c8b6ded76d42fe8b31c7a6

SHA1
f05072c4caf5b38c17ad27d6099cd9c9aef689e6

SHA256
0a9178ca7ffdd4b78bfbee559c8ca458fa7efb424dcd15ca905c4909c362507d

SHA512
5dcccf42baa31a625f66237e538d6b8397b5ff34db9e7e2a462646b4fee4987075139d9622234ee67e6e4fa684cc6b5aebe0ad13242706e3203ee6b30da68a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nxeoaco.exe

Filesize
41KB

MD5
563b24aab3c8b6ded76d42fe8b31c7a6

SHA1
f05072c4caf5b38c17ad27d6099cd9c9aef689e6

SHA256
0a9178ca7ffdd4b78bfbee559c8ca458fa7efb424dcd15ca905c4909c362507d

SHA512
5dcccf42baa31a625f66237e538d6b8397b5ff34db9e7e2a462646b4fee4987075139d9622234ee67e6e4fa684cc6b5aebe0ad13242706e3203ee6b30da68a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwubdzj.t

Filesize
124KB

MD5
c9e86d60021fbb741bf3c10356666f9b

SHA1
16c2449013e596ae1b4141e0bf374763562f92f2

SHA256
bf223e31c7b4010b3cbfa8e184a4f9a854fe95e56ae15a3dc7ab609d6739fbd5

SHA512
58512f0609b1a2d732040d85844e97b5d5dee6e2d7ac329e52d546d7d58c1e8ad1933e30678f58a8cecf00e748efb4adcec3e95b14ab2fda7f519ab41f191581

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\0f5007522459c86e95ffcc62f32308f1_6d187d53-139c-415c-b71c-a4b59992e636

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
memory/2736-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2736-144-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2736-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2736-165-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing