lokibot | eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4

General

Target

5cc6fc2f78336352bac6975edafa2c1a.exe
Size

532KB
MD5

5cc6fc2f78336352bac6975edafa2c1a
SHA1

ccb86ddabe85e1ef348ff3dc5f24577040da5f28
SHA256

eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4
SHA512

2625083acdf607189a41b24f9da874f37714d43318718b2e5291e0fb0651462ffee4c2b11f4f69884f85d222a0d8955158dacad0afb10226c92aa9d9b78b33a7

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gb4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	5cc6fc2f78336352bac6975edafa2c1a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	5cc6fc2f78336352bac6975edafa2c1a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	5cc6fc2f78336352bac6975edafa2c1a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description pid process target process

PID 3612 set thread context of 4368 3612 5cc6fc2f78336352bac6975edafa2c1a.exe 5cc6fc2f78336352bac6975edafa2c1a.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

pid process

3612 5cc6fc2f78336352bac6975edafa2c1a.exe
3612 5cc6fc2f78336352bac6975edafa2c1a.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

pid process

4368 5cc6fc2f78336352bac6975edafa2c1a.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe5cc6fc2f78336352bac6975edafa2c1a.exe

description pid process

Token: SeDebugPrivilege 3612 5cc6fc2f78336352bac6975edafa2c1a.exe
Token: SeDebugPrivilege 4368 5cc6fc2f78336352bac6975edafa2c1a.exe

description	pid	process	target process
PID 3612 set thread context of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe

pid	process
3612	5cc6fc2f78336352bac6975edafa2c1a.exe
3612	5cc6fc2f78336352bac6975edafa2c1a.exe

pid	process
4368	5cc6fc2f78336352bac6975edafa2c1a.exe

description	pid	process
Token: SeDebugPrivilege	3612	5cc6fc2f78336352bac6975edafa2c1a.exe
Token: SeDebugPrivilege	4368	5cc6fc2f78336352bac6975edafa2c1a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description	pid	process	target process
PID 3612 wrote to memory of 4460	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4460	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4460	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe
PID 3612 wrote to memory of 4368	3612	5cc6fc2f78336352bac6975edafa2c1a.exe	5cc6fc2f78336352bac6975edafa2c1a.exe

outlook_office_path 1 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	5cc6fc2f78336352bac6975edafa2c1a.exe

outlook_win_path 1 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	5cc6fc2f78336352bac6975edafa2c1a.exe

C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe
"C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe
"C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe"
2⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe
"C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3612-118-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/3612-120-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/3612-121-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/3612-122-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/3612-123-0x0000000005220000-0x000000000571E000-memory.dmp

Filesize
5.0MB

Download
memory/3612-124-0x0000000005540000-0x0000000005546000-memory.dmp

Filesize
24KB

Download
memory/3612-125-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/3612-126-0x0000000005F90000-0x0000000005FD4000-memory.dmp

Filesize
272KB

Download
memory/4368-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4368-128-0x00000000004139DE-mapping.dmp

Download
memory/4368-129-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads