lokibot | 283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3

Analysis

max time kernel
139s
max time network
154s
platform
windows7_x64
resource
win7-20220331-en
submitted
01/04/2022, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c313fe7562459e017b46c4dd280e88b.exe
Size 233KB
Sample220401-r2egrahbdm
SHA256 283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3
MD5 1c313fe7562459e017b46c4dd280e88b
SHA1 b42cbb395dd07114d23e390a82162005b1287617
SHA512 9bfad217569804cd260d4145643761fc264a7ef2021e6b80786487d9420b2c41521966337959c3409a23f899f7f1ab1148cce50f40e2cb6392f28327204a6fad
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://62.197.136.176/userbob/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1868	smkyhybqb.exe
952	smkyhybqb.exe

Loads dropped DLL 2 IoCs

pid	Process
1096	1c313fe7562459e017b46c4dd280e88b.exe
1868	smkyhybqb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	smkyhybqb.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	smkyhybqb.exe
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	smkyhybqb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 952	1868	smkyhybqb.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	smkyhybqb.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1868	1096	1c313fe7562459e017b46c4dd280e88b.exe	28
PID 1096 wrote to memory of 1868	1096	1c313fe7562459e017b46c4dd280e88b.exe	28
PID 1096 wrote to memory of 1868	1096	1c313fe7562459e017b46c4dd280e88b.exe	28
PID 1096 wrote to memory of 1868	1096	1c313fe7562459e017b46c4dd280e88b.exe	28
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29
PID 1868 wrote to memory of 952	1868	smkyhybqb.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	smkyhybqb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	smkyhybqb.exe

C:\Users\Admin\AppData\Local\Temp\1c313fe7562459e017b46c4dd280e88b.exe
"C:\Users\Admin\AppData\Local\Temp\1c313fe7562459e017b46c4dd280e88b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
  C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe C:\Users\Admin\AppData\Local\Temp\nehwgn
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
    C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe C:\Users\Admin\AppData\Local\Temp\nehwgn
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nehwgn

Path C:\Users\Admin\AppData\Local\Temp\nehwgn
Size 4KB
SHA256 21748760571272a5d33caaeded7c8dbfe7dff18380675a755921427468e005f8
MD5 3266f350cdd2e270a9ffaa5e3d5c2359
SHA1 e9296bb0702349ced12d02e7c40c1d49dac8f172
SHA512 25d2d67b1f0f1df51705c0e7bde4c6776a9f6c3a08ece3bcc21bc123f1ab2fd3852c9783018fd962e75ddeae371a01d4b00e2f832a2f8604281d8b55cea04a1b
SSDEEP 96:+as4Z60MSh3la7rNTe620hDMX0ZfCY59PFQrEwxzChLTMopx9uUNhuatq/f2Jowk:+J4ZVHh3qrNCSBKY55qgw4huaQ/Th/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

smkyhybqb.exe

Path C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
Size 4KB
SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
MD5 737512edd20fbcc3b0d83453d594d2d6
SHA1 d3918e64dc4830c5a6db82d85ec685dfdec5202d
SHA512 50052368599d2ac34345517337529f90260ba915d6dd4f3190332dad5d522cddc3aba9dcb441558fc9c9d801e08214d723cb6db7dd505c4aa2187f1f3af2d793
SSDEEP 48:vpgUa7AaivLWF5hnvn73HBIM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmRY7:BvzahPreMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

smkyhybqb.exe

Path C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
Size 4KB
SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
MD5 737512edd20fbcc3b0d83453d594d2d6
SHA1 d3918e64dc4830c5a6db82d85ec685dfdec5202d
SHA512 50052368599d2ac34345517337529f90260ba915d6dd4f3190332dad5d522cddc3aba9dcb441558fc9c9d801e08214d723cb6db7dd505c4aa2187f1f3af2d793
SSDEEP 48:vpgUa7AaivLWF5hnvn73HBIM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmRY7:BvzahPreMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

smkyhybqb.exe

Path C:\Users\Admin\AppData\Local\Temp\smkyhybqb.exe
Size 4KB
SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
MD5 737512edd20fbcc3b0d83453d594d2d6
SHA1 d3918e64dc4830c5a6db82d85ec685dfdec5202d
SHA512 50052368599d2ac34345517337529f90260ba915d6dd4f3190332dad5d522cddc3aba9dcb441558fc9c9d801e08214d723cb6db7dd505c4aa2187f1f3af2d793
SSDEEP 48:vpgUa7AaivLWF5hnvn73HBIM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmRY7:BvzahPreMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

u9gjxz40tq93r

Path C:\Users\Admin\AppData\Local\Temp\u9gjxz40tq93r
Size 213KB
SHA256 8847cb0d1252b7955483528d28928f95c532dded6897e67a7d1b26e5a9f68a43
MD5 956273a2fcf51c8d994d9cfa16a3e3ca
SHA1 7b1932c436d9e9142ee7de427a0e15ff4d0cf908
SHA512 d9de9560017509b0645cae9ccb44c772e90f5d177ea8f1b3d252aea1052f78c30ff147234b2c626753bab815a865e9f3a590283696e86ddd1b1a6b22d5bec682
SSDEEP 6144:mUcuiDfimVSunMTaGgr8LHSWUgSykKjajqJ:mUr26mVPw7rvU1KWj6
MD5 SHA1 SHA512 SSDEEP

Submit Download

smkyhybqb.exe

Path \Users\Admin\AppData\Local\Temp\smkyhybqb.exe
Size 4KB
SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
MD5 737512edd20fbcc3b0d83453d594d2d6
SHA1 d3918e64dc4830c5a6db82d85ec685dfdec5202d
SHA512 50052368599d2ac34345517337529f90260ba915d6dd4f3190332dad5d522cddc3aba9dcb441558fc9c9d801e08214d723cb6db7dd505c4aa2187f1f3af2d793
SSDEEP 48:vpgUa7AaivLWF5hnvn73HBIM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmRY7:BvzahPreMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

smkyhybqb.exe

Path \Users\Admin\AppData\Local\Temp\smkyhybqb.exe
Size 4KB
SHA256 8ada00bad8b3aed77be669cc4b96e3195b648ab985d761953879baf806e7eafc
MD5 737512edd20fbcc3b0d83453d594d2d6
SHA1 d3918e64dc4830c5a6db82d85ec685dfdec5202d
SHA512 50052368599d2ac34345517337529f90260ba915d6dd4f3190332dad5d522cddc3aba9dcb441558fc9c9d801e08214d723cb6db7dd505c4aa2187f1f3af2d793
SSDEEP 48:vpgUa7AaivLWF5hnvn73HBIM+ryAM+ryBp13v+fA7yQ9IPTIDW6B0LYmRY7:BvzahPreMSyAMSyBp13vqgyQXkVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/952-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1096-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads