lokibot | d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0

General

Target

gunzipped.exe
Size

202KB
MD5

a76b143e354a2ac9f363616ff4f8b239
SHA1

51bb9b6f0c004d4532ae7f83b58554c924f4d3cc
SHA256

d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0
SHA512

08caf51783da2b857699ca0063410464e35faeec64a44d4e35ed7e098f5fa6447d36c8a01de7ab9ecbd863e690a910328ccb503e66a9ef679a98031bf5be5369

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

https://jnxxx1.xyz/JRM/w2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Msbuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Msbuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Msbuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

gunzipped.exe

description pid process target process

PID 492 set thread context of 1448 492 gunzipped.exe Msbuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

gunzipped.exeMsbuild.exe

description pid process

Token: SeDebugPrivilege 492 gunzipped.exe
Token: SeDebugPrivilege 1448 Msbuild.exe

description	pid	process	target process
PID 492 set thread context of 1448	492	gunzipped.exe	Msbuild.exe

description	pid	process
Token: SeDebugPrivilege	492	gunzipped.exe
Token: SeDebugPrivilege	1448	Msbuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

gunzipped.exe

description	pid	process	target process
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe
PID 492 wrote to memory of 1448	492	gunzipped.exe	Msbuild.exe

outlook_office_path 1 IoCs

Processes:

Msbuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe

outlook_win_path 1 IoCs

Processes:

Msbuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Msbuild.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-115-0x00000000006A0000-0x00000000006D4000-memory.dmp

Filesize
208KB

Download
memory/492-116-0x00000000006A0000-0x00000000006D4000-memory.dmp

Filesize
208KB

Download
memory/492-117-0x0000000001060000-0x0000000001062000-memory.dmp

Filesize
8KB

Download
memory/492-118-0x0000000000B00000-0x0000000000B26000-memory.dmp

Filesize
152KB

Download
memory/492-119-0x0000000000B20000-0x0000000000B30000-memory.dmp

Filesize
64KB

Download
memory/492-120-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/1448-121-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1448-122-0x00000000004139DE-mapping.dmp

Download
memory/1448-123-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads