lokibot | 99ed9b42e17e727c0fee079cf09ee5930e56b241323da08c3f97ad36b7458416

General

Target
d16a0938a075168a8a2a371a549ab83e.exe
Size 331KB
Sample220228-llgz2sfcdr
SHA256 99ed9b42e17e727c0fee079cf09ee5930e56b241323da08c3f97ad36b7458416
MD5 d16a0938a075168a8a2a371a549ab83e
SHA1 b042d8c04884bd41826b77de36ed39a486f07ab7
SHA512 1f2aa647855f26c3cfe835ee060fdc6d8c7d7e2fac1f3aad0e3bd19b8a81c07989525089e8602368ff0b3bf9e2db0726e46f7a8d964c15f3aa902849a8a77d43
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://hstfurnaces.net/gc15/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
3464	qyjmzs.exe
3608	qyjmzs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qyjmzs.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	qyjmzs.exe
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qyjmzs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 3608	3464	qyjmzs.exe	61

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 3464	688	d16a0938a075168a8a2a371a549ab83e.exe	60
PID 688 wrote to memory of 3464	688	d16a0938a075168a8a2a371a549ab83e.exe	60
PID 688 wrote to memory of 3464	688	d16a0938a075168a8a2a371a549ab83e.exe	60
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61
PID 3464 wrote to memory of 3608	3464	qyjmzs.exe	61

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qyjmzs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qyjmzs.exe

C:\Users\Admin\AppData\Local\Temp\d16a0938a075168a8a2a371a549ab83e.exe
"C:\Users\Admin\AppData\Local\Temp\d16a0938a075168a8a2a371a549ab83e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Users\Admin\AppData\Local\Temp\qyjmzs.exe
  C:\Users\Admin\AppData\Local\Temp\qyjmzs.exe C:\Users\Admin\AppData\Local\Temp\hrdax
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\qyjmzs.exe
    C:\Users\Admin\AppData\Local\Temp\qyjmzs.exe C:\Users\Admin\AppData\Local\Temp\hrdax
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:3608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-134-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3608-136-0x0000000000400000-0x00000000004A2000-memory.dmp