lokibot | c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167

General

Target

vbc.exe
Size

122KB
MD5

3a03e80e3178b42899065511c3842b59
SHA1

e374aae94e475aaa9a8ad7cb0a7f72c9e4e8c326
SHA256

c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167
SHA512

3895598a68d7e630d635c7cdab73339b14dae04a28e01f4b5ca06cafc3b912fed12a2c125def9b8385b2bc2ccda6d6d09ccf7cbf906046560ed8bc475c835722

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://panel-report-logs.ml/nnajnr/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

Processes:

gswlpnzal.exegswlpnzal.exe

pid	Process
980	gswlpnzal.exe
1596	gswlpnzal.exe

Loads dropped DLL 2 IoCs

Processes:

vbc.exegswlpnzal.exe

pid	Process
548	vbc.exe
980	gswlpnzal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

gswlpnzal.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	gswlpnzal.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gswlpnzal.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gswlpnzal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

gswlpnzal.exe

description	pid	Process	procid_target
PID 980 set thread context of 1596	980	gswlpnzal.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gswlpnzal.exe

description	pid	Process
Token: SeDebugPrivilege	1596	gswlpnzal.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

vbc.exegswlpnzal.exe

description	pid	Process	procid_target
PID 548 wrote to memory of 980	548	vbc.exe	27
PID 548 wrote to memory of 980	548	vbc.exe	27
PID 548 wrote to memory of 980	548	vbc.exe	27
PID 548 wrote to memory of 980	548	vbc.exe	27
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28
PID 980 wrote to memory of 1596	980	gswlpnzal.exe	28

outlook_office_path 1 IoCs

Processes:

gswlpnzal.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	gswlpnzal.exe

outlook_win_path 1 IoCs

Processes:

gswlpnzal.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	gswlpnzal.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe
  C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe C:\Users\Admin\AppData\Local\Temp\gtpoyjbk
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe
    C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe C:\Users\Admin\AppData\Local\Temp\gtpoyjbk
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4h48dz4ylt368kesa

Filesize
103KB

MD5
6ab5f34b0162b0155a58a16cf925b5f4

SHA1
1bf585184fb51bc0220a0ca7be6ea84f752ff684

SHA256
c29a2260d9013915d3ea8600aa69d2a869e9439122378c7faa2e16bd299c5c14

SHA512
b75f6581036814156b06320ecb1dc065e8fc3a3c5afb3a1353173e18988946e37ac42bb43e15bc3e5153e2e71ab793529f68d9c5435cf150dd640d37bb85ed41

Download Submit
C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe

Filesize
3KB

MD5
18ce22474748c18844ff0aa59d373ef8

SHA1
b96d92d60a789bc20d3559f9bcfbdc00fbcaef48

SHA256
ff29986d18146c430c2c94f803f4aa8ca7465f0e35597d5f4719d85ae7930dec

SHA512
6f186f041869629acb5c7ec65f6d419579a5f9b02b626819733e5640ce4926e135e37f62c9c14c35f0b792a01617c81603cdbfc8053091a240df6caa8e8883c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe

Filesize
3KB

MD5
18ce22474748c18844ff0aa59d373ef8

SHA1
b96d92d60a789bc20d3559f9bcfbdc00fbcaef48

SHA256
ff29986d18146c430c2c94f803f4aa8ca7465f0e35597d5f4719d85ae7930dec

SHA512
6f186f041869629acb5c7ec65f6d419579a5f9b02b626819733e5640ce4926e135e37f62c9c14c35f0b792a01617c81603cdbfc8053091a240df6caa8e8883c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\gswlpnzal.exe

Filesize
3KB

MD5
18ce22474748c18844ff0aa59d373ef8

SHA1
b96d92d60a789bc20d3559f9bcfbdc00fbcaef48

SHA256
ff29986d18146c430c2c94f803f4aa8ca7465f0e35597d5f4719d85ae7930dec

SHA512
6f186f041869629acb5c7ec65f6d419579a5f9b02b626819733e5640ce4926e135e37f62c9c14c35f0b792a01617c81603cdbfc8053091a240df6caa8e8883c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\gtpoyjbk

Filesize
4KB

MD5
18cf2cefae5c4a6fb289379526523d38

SHA1
04b390c1a78d148d4ed5513ada723954a988b0bd

SHA256
0cfa5a5e0b2aa239cbfb4a60d378b1b5fef8aef6fdc06f732589b68700ccad72

SHA512
214773122f7636ec801abc5cc2bbe9f3625aa0142db724764580baf9ba495be32e6a3d4ea361a2a138c61761057fd9810091e8881b930dcd756bd086243ce16d

Download Submit
\Users\Admin\AppData\Local\Temp\gswlpnzal.exe

Filesize
3KB

MD5
18ce22474748c18844ff0aa59d373ef8

SHA1
b96d92d60a789bc20d3559f9bcfbdc00fbcaef48

SHA256
ff29986d18146c430c2c94f803f4aa8ca7465f0e35597d5f4719d85ae7930dec

SHA512
6f186f041869629acb5c7ec65f6d419579a5f9b02b626819733e5640ce4926e135e37f62c9c14c35f0b792a01617c81603cdbfc8053091a240df6caa8e8883c6

Download Submit
\Users\Admin\AppData\Local\Temp\gswlpnzal.exe

Filesize
3KB

MD5
18ce22474748c18844ff0aa59d373ef8

SHA1
b96d92d60a789bc20d3559f9bcfbdc00fbcaef48

SHA256
ff29986d18146c430c2c94f803f4aa8ca7465f0e35597d5f4719d85ae7930dec

SHA512
6f186f041869629acb5c7ec65f6d419579a5f9b02b626819733e5640ce4926e135e37f62c9c14c35f0b792a01617c81603cdbfc8053091a240df6caa8e8883c6

Download Submit
memory/548-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x0000000000000000-mapping.dmp

Download
memory/1596-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1596-64-0x00000000004139DE-mapping.dmp

Download
memory/1596-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1596-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads