lokibot | 7b1da3704d0228cebf239b9c8935d500fef9b193c2ca2ba9e89cfd0724acd41c

General

Target
c64f813073e0f774fd5765c25a3e0d3c.exe
Size 149KB
Sample220422-mc4ccsgdcn
SHA256 7b1da3704d0228cebf239b9c8935d500fef9b193c2ca2ba9e89cfd0724acd41c
MD5 c64f813073e0f774fd5765c25a3e0d3c
SHA1 e27a19d1cf59907ba20ef6b28d523d25ee11a11c
SHA512 d45e4e38293bd033796c8a90b3123fbe7d37adc038bb59089c643f58013a66689acf6faaa0eabfdf296db497de08f5407d6d0fc1a2533d2b7cc99a634f153a25
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gd17/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
5040	ujpkhj.exe
3612	ujpkhj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ujpkhj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ujpkhj.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ujpkhj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 3612	5040	ujpkhj.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	ujpkhj.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5040	2584	c64f813073e0f774fd5765c25a3e0d3c.exe	82
PID 2584 wrote to memory of 5040	2584	c64f813073e0f774fd5765c25a3e0d3c.exe	82
PID 2584 wrote to memory of 5040	2584	c64f813073e0f774fd5765c25a3e0d3c.exe	82
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83
PID 5040 wrote to memory of 3612	5040	ujpkhj.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ujpkhj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ujpkhj.exe

C:\Users\Admin\AppData\Local\Temp\c64f813073e0f774fd5765c25a3e0d3c.exe
"C:\Users\Admin\AppData\Local\Temp\c64f813073e0f774fd5765c25a3e0d3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe
  C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe C:\Users\Admin\AppData\Local\Temp\vzbvrlggq
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe
    C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe C:\Users\Admin\AppData\Local\Temp\vzbvrlggq
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imtoddj4zyghsyjzv

Path C:\Users\Admin\AppData\Local\Temp\imtoddj4zyghsyjzv
Size 103KB
SHA256 672c82ab2b221321f4991f860d8ce25c0dda75435d4522ff0decf984d20874a7
MD5 1c8c77491d6b4f717f4dbe3e62bdc54e
SHA1 e1fc48cc6743d1f30f7c1c05ed85cb2549fa3373
SHA512 fdddf325a274f08ba77bd19b0b6d2b677894172c68dea74c04ed0350f9cd7ded05429e4ab09679777042b4c8f9c95e8c8c7908076b721916a94a611b1e5432a4
SSDEEP 1536:cJ+wMenh74wiMVZfiibRsGokzQs+oOkfEq4LfhfMtfH6cW2/xkqn+nnnnnnnnnnf:iQMVZfiKmbC3OkfERJktfZWwxa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ujpkhj.exe

Path C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe
Size 65KB
SHA256 c5b437496954aba9cbeb4a53344287ba7fbbb895eb758e682c4211eb9092a4c1
MD5 4ad05a9f71df39597dbaa1a0ce85fcdb
SHA1 d78847bb4c21761a34018f0f619cfe4c54229a86
SHA512 cb3d1f1cd856051dea9a43810f873f2d962ebb3e8667e005b1761b3ecc47770c943337322bfc3edabeafec89aed6f70cbc06e6f69926527aeeccd77df37e137c
SSDEEP 768:KJs8jNOHkUyJ9/qSWIw8bSZ70nuvQ7n0bnb9iBKahNKtc8WTsWjcdCaXk+9t:A7tqSn9bTwQ7S+Kayc8qsWjcdCal
MD5 SHA1 SHA512 SSDEEP

Submit Download

ujpkhj.exe

Path C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe
Size 65KB
SHA256 c5b437496954aba9cbeb4a53344287ba7fbbb895eb758e682c4211eb9092a4c1
MD5 4ad05a9f71df39597dbaa1a0ce85fcdb
SHA1 d78847bb4c21761a34018f0f619cfe4c54229a86
SHA512 cb3d1f1cd856051dea9a43810f873f2d962ebb3e8667e005b1761b3ecc47770c943337322bfc3edabeafec89aed6f70cbc06e6f69926527aeeccd77df37e137c
SSDEEP 768:KJs8jNOHkUyJ9/qSWIw8bSZ70nuvQ7n0bnb9iBKahNKtc8WTsWjcdCaXk+9t:A7tqSn9bTwQ7S+Kayc8qsWjcdCal
MD5 SHA1 SHA512 SSDEEP

Submit Download

ujpkhj.exe

Path C:\Users\Admin\AppData\Local\Temp\ujpkhj.exe
Size 65KB
SHA256 c5b437496954aba9cbeb4a53344287ba7fbbb895eb758e682c4211eb9092a4c1
MD5 4ad05a9f71df39597dbaa1a0ce85fcdb
SHA1 d78847bb4c21761a34018f0f619cfe4c54229a86
SHA512 cb3d1f1cd856051dea9a43810f873f2d962ebb3e8667e005b1761b3ecc47770c943337322bfc3edabeafec89aed6f70cbc06e6f69926527aeeccd77df37e137c
SSDEEP 768:KJs8jNOHkUyJ9/qSWIw8bSZ70nuvQ7n0bnb9iBKahNKtc8WTsWjcdCaXk+9t:A7tqSn9bTwQ7S+Kayc8qsWjcdCal
MD5 SHA1 SHA512 SSDEEP

Submit Download

vzbvrlggq

Path C:\Users\Admin\AppData\Local\Temp\vzbvrlggq
Size 5KB
SHA256 db3f6edda774131242338620c7a739540b9a1313bad33d71ba3b1f2f352daf4e
MD5 cc3a82797736a1bf4b7930a47d2ed928
SHA1 e97be9bccf65d3057f9819e2c2d89937bb78e785
SHA512 2a5e9bf731db685857901dc9b21d9df72f220e31b3249516fce2c4df700dccfb49718c95c5b409ca8db2af9755a65ce1a6e743025da76fc7cc3807bf53b14a56
SSDEEP 96:U7l8r5lHMJD0MVwfDOG1lv2cv1V0hL45W5WfOfHAsrMf7cBEpJfJkyf7uGBdoLl4:R3HMN0SaDOoB2cv/0hL45W5fAsrwcBE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3612-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3612-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3612-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads