lokibot | 17550ab5a1de6ed2113f887ef72eebd0cac241a9bb72d0907926b972e38f9ae7

General

Target
vbc.exe
Size 239KB
Sample220328-ng5xesdhel
SHA256 17550ab5a1de6ed2113f887ef72eebd0cac241a9bb72d0907926b972e38f9ae7
MD5 cdde35311a891577086902a4958525ec
SHA1 0e8141547df534bd7709df64933d4da052c5715c
SHA512 2ad7054be33486e90439897b58320d3d685cc9db3fa7bdba758dcacd9d21f43a6baa407e91cda079f90febb181b8ef036205b9fc2af1552420017862fd1e6fc7
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://outlook-webpage-auth.ml/worldwide/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1220	qajhjqj.exe
792	qajhjqj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qajhjqj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	qajhjqj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qajhjqj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 792	1220	qajhjqj.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	qajhjqj.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1220	1708	vbc.exe	80
PID 1708 wrote to memory of 1220	1708	vbc.exe	80
PID 1708 wrote to memory of 1220	1708	vbc.exe	80
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81
PID 1220 wrote to memory of 792	1220	qajhjqj.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qajhjqj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qajhjqj.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe
  C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe C:\Users\Admin\AppData\Local\Temp\jjcdquco
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe
    C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe C:\Users\Admin\AppData\Local\Temp\jjcdquco
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iliu4wipsy3v0df

Path C:\Users\Admin\AppData\Local\Temp\iliu4wipsy3v0df
Size 214KB
SHA256 9d0e36aef0319893d3aec5fed55f5e883629018d8f9d5b10d4439ea7a43af52a
MD5 3d8744eceb9afebc05379ff44d90899e
SHA1 54724deb919a6729736d2a7c7db3348c676058a6
SHA512 a4cf7ddd55aea058f7b3e7a8f3bee9a754a945dabc64c5fd87c9df5e7c02b6e1c0b8591d623ed0429c79fb3646d7836cde899257f6b02cecce6187b2dda29d5d
MD5 SHA1 SHA512

Submit Download

jjcdquco

Path C:\Users\Admin\AppData\Local\Temp\jjcdquco
Size 4KB
SHA256 9804df24a9f9ed6ba4274989a583863314541860cee07d4751ee63d3427d2871
MD5 c6fbfc72af64509dd6a20b7f46b10de0
SHA1 2aa84af9511d6ae814ddf1642465ca1279281f11
SHA512 febaa1abe15dd053f30df582bb735bce1a6d5657a3483d35337060e2cc2a8445238c1fce3df7c9fa5d0e0494b9353ace5bed036d0db8e18161ec50d020bd4ec6
MD5 SHA1 SHA512

Submit Download

qajhjqj.exe

Path C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe
Size 3KB
SHA256 63e7fbc25104e6aed288d9d4fa3b1633d2736ff67ad9f486a1a7184397e7d025
MD5 5f4bb5a82ad73bdaffe043c301153081
SHA1 f77f7c871c6652b9ab0c3c5b8767ac6c5d1d9549
SHA512 37607b1e1e2cae45ce383b194aa9c2236864e548e9fdab14ca3635d3d459af6ec9499d1315c08efa32d53e2e94568b4ea1e6cbddc902a084a81580a3a08ceeab
MD5 SHA1 SHA512

Submit Download

qajhjqj.exe

Path C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe
Size 3KB
SHA256 63e7fbc25104e6aed288d9d4fa3b1633d2736ff67ad9f486a1a7184397e7d025
MD5 5f4bb5a82ad73bdaffe043c301153081
SHA1 f77f7c871c6652b9ab0c3c5b8767ac6c5d1d9549
SHA512 37607b1e1e2cae45ce383b194aa9c2236864e548e9fdab14ca3635d3d459af6ec9499d1315c08efa32d53e2e94568b4ea1e6cbddc902a084a81580a3a08ceeab
MD5 SHA1 SHA512

Submit Download

qajhjqj.exe

Path C:\Users\Admin\AppData\Local\Temp\qajhjqj.exe
Size 3KB
SHA256 63e7fbc25104e6aed288d9d4fa3b1633d2736ff67ad9f486a1a7184397e7d025
MD5 5f4bb5a82ad73bdaffe043c301153081
SHA1 f77f7c871c6652b9ab0c3c5b8767ac6c5d1d9549
SHA512 37607b1e1e2cae45ce383b194aa9c2236864e548e9fdab14ca3635d3d459af6ec9499d1315c08efa32d53e2e94568b4ea1e6cbddc902a084a81580a3a08ceeab
MD5 SHA1 SHA512

Submit Download

memory/792-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/792-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads