lokibot | 463688d6dfb7d1afcb6e3b13110542de17dd81cd271a79beb55d2916b5563c4c

Analysis

max time kernel
121s
max time network
134s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75d7e4d1730247c05bd66666c8902d56.exe
Size

260KB
MD5

75d7e4d1730247c05bd66666c8902d56
SHA1

2670b4a3ee00a9c436d7ad5afcbf0176684225c7
SHA256

463688d6dfb7d1afcb6e3b13110542de17dd81cd271a79beb55d2916b5563c4c
SHA512

d4c13c61d5dcfbf0524a11119fe748f3db9c3eebe5c7e27b62aef6cf48338e6cba180a6cac2f47317c9306e18d593a792f314cd46af622293be67c1d288f1dca

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://63.250.40.204/~wpdemo/file.php?search=386869

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

75d7e4d1730247c05bd66666c8902d56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	75d7e4d1730247c05bd66666c8902d56.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	75d7e4d1730247c05bd66666c8902d56.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	75d7e4d1730247c05bd66666c8902d56.exe

outlook_office_path 1 IoCs

Processes:

75d7e4d1730247c05bd66666c8902d56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	75d7e4d1730247c05bd66666c8902d56.exe

outlook_win_path 1 IoCs

Processes:

75d7e4d1730247c05bd66666c8902d56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	75d7e4d1730247c05bd66666c8902d56.exe

C:\Users\Admin\AppData\Local\Temp\75d7e4d1730247c05bd66666c8902d56.exe
"C:\Users\Admin\AppData\Local\Temp\75d7e4d1730247c05bd66666c8902d56.exe"
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3804-116-0x0000000004C50000-0x0000000004C6B000-memory.dmp

Filesize
108KB

Download
memory/3804-115-0x0000000004C20000-0x0000000004C2F000-memory.dmp

Filesize
60KB

Download
memory/3804-117-0x0000000000400000-0x0000000002F07000-memory.dmp

Filesize
43.0MB

Download