lokibot | 84e31f5894eec64eb89b66b3630a5da22db8a7916fd51604c4c579a491506e0e

General

Target
gunzipped.exe
Size 390KB
Sample220321-fejbmshdaj
SHA256 84e31f5894eec64eb89b66b3630a5da22db8a7916fd51604c4c579a491506e0e
MD5 52a2246fc94b2b333adced3ae049012e
SHA1 3f50de8ae020d4f0b709f470c40201b61119d50c
SHA512 cdf56ca7463b442d75943d84dcb669eee458bd1330b901a7e21aacaad4fd32965910abf923b51619b029e83472c95b0211f66811d0b1a4721252e5317e267f72
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://s473442.smrtp.ru/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1980	qbwcdld.exe
584	qbwcdld.exe

Loads dropped DLL 3 IoCs

pid	Process
1996	gunzipped.exe
1996	gunzipped.exe
1980	qbwcdld.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qbwcdld.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	qbwcdld.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qbwcdld.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 584	1980	qbwcdld.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	584	qbwcdld.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1980	1996	gunzipped.exe	27
PID 1996 wrote to memory of 1980	1996	gunzipped.exe	27
PID 1996 wrote to memory of 1980	1996	gunzipped.exe	27
PID 1996 wrote to memory of 1980	1996	gunzipped.exe	27
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28
PID 1980 wrote to memory of 584	1980	qbwcdld.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qbwcdld.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qbwcdld.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\qbwcdld.exe
  C:\Users\Admin\AppData\Local\Temp\qbwcdld.exe C:\Users\Admin\AppData\Local\Temp\gziigzt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\qbwcdld.exe
    C:\Users\Admin\AppData\Local\Temp\qbwcdld.exe C:\Users\Admin\AppData\Local\Temp\gziigzt
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/584-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1996-54-0x0000000074C61000-0x0000000074C63000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads