lokibot | 2d1e4d0f7d7ef87c3acf442a0a48326b156a9e2a6ef93efcf274d1cccc14eb55

General

Target
a8f3e8814c7dc60e2f67b3052c839eb6.exe
Size 122KB
Sample220428-htr87sbcf8
SHA256 2d1e4d0f7d7ef87c3acf442a0a48326b156a9e2a6ef93efcf274d1cccc14eb55
MD5 a8f3e8814c7dc60e2f67b3052c839eb6
SHA1 c7a61d07920d95454c43e370bffa1d1938aa0248
SHA512 7f6e386d039370b5ad7bd79c9fbe96f96edd03497c57a96c1c4483af201d440b0f0fe62e3f08e53466e0af9de1d1551a1a3da3d45ad12ed193e9a0c2a33acbf2
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
2352	bgnshbbx.exe
480	bgnshbbx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bgnshbbx.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bgnshbbx.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	bgnshbbx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 480	2352	bgnshbbx.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	bgnshbbx.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2352	1540	a8f3e8814c7dc60e2f67b3052c839eb6.exe	82
PID 1540 wrote to memory of 2352	1540	a8f3e8814c7dc60e2f67b3052c839eb6.exe	82
PID 1540 wrote to memory of 2352	1540	a8f3e8814c7dc60e2f67b3052c839eb6.exe	82
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83
PID 2352 wrote to memory of 480	2352	bgnshbbx.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	bgnshbbx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	bgnshbbx.exe

C:\Users\Admin\AppData\Local\Temp\a8f3e8814c7dc60e2f67b3052c839eb6.exe
"C:\Users\Admin\AppData\Local\Temp\a8f3e8814c7dc60e2f67b3052c839eb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe
  C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe C:\Users\Admin\AppData\Local\Temp\frgvzkv
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe
    C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe C:\Users\Admin\AppData\Local\Temp\frgvzkv
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bgnshbbx.exe

Path C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe
Size 4KB
SHA256 2b442d6f17530802896f415d26c86bbe056556e6c648535645fbb20eea010e56
MD5 1c0df17b97f4316b965e48fee43d335a
SHA1 8ae5d4e0ca518845a95cba171ec03fd505af19b8
SHA512 ce86abf9bda5ab4e63b7f519eb949e3dc843a39477797e1fc49b3d2ddafde6a360cd24dc7bcb14976743d83d043db6784e8bfc2cee0dcca3225a650400bb4076
SSDEEP 48:vpgq8t8DifpsBUw6csgka6/VM8NR8Nhe5ydS4Kb0e4azLMDYmR:B7Dssaw6la69wwaKbjyVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bgnshbbx.exe

Path C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe
Size 4KB
SHA256 2b442d6f17530802896f415d26c86bbe056556e6c648535645fbb20eea010e56
MD5 1c0df17b97f4316b965e48fee43d335a
SHA1 8ae5d4e0ca518845a95cba171ec03fd505af19b8
SHA512 ce86abf9bda5ab4e63b7f519eb949e3dc843a39477797e1fc49b3d2ddafde6a360cd24dc7bcb14976743d83d043db6784e8bfc2cee0dcca3225a650400bb4076
SSDEEP 48:vpgq8t8DifpsBUw6csgka6/VM8NR8Nhe5ydS4Kb0e4azLMDYmR:B7Dssaw6la69wwaKbjyVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bgnshbbx.exe

Path C:\Users\Admin\AppData\Local\Temp\bgnshbbx.exe
Size 4KB
SHA256 2b442d6f17530802896f415d26c86bbe056556e6c648535645fbb20eea010e56
MD5 1c0df17b97f4316b965e48fee43d335a
SHA1 8ae5d4e0ca518845a95cba171ec03fd505af19b8
SHA512 ce86abf9bda5ab4e63b7f519eb949e3dc843a39477797e1fc49b3d2ddafde6a360cd24dc7bcb14976743d83d043db6784e8bfc2cee0dcca3225a650400bb4076
SSDEEP 48:vpgq8t8DifpsBUw6csgka6/VM8NR8Nhe5ydS4Kb0e4azLMDYmR:B7Dssaw6la69wwaKbjyVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

frgvzkv

Path C:\Users\Admin\AppData\Local\Temp\frgvzkv
Size 4KB
SHA256 c897408aa88af75ade3c170c60608a82ff761a42f0a2336692056df01bf2a02e
MD5 b3b3c80e194c9e84c64f02df316c8a11
SHA1 b7151bf528a9e0334ced3476df4381ba39f49bd0
SHA512 5fa048fce4ab0c554206bb2fd0cdd6243fdc0f6ce501bd3a0c8b5fbb9ea3a57a7bc909ca86e6f3c19b0cd8dbeeb823e5f91ddf9efe3e9fbb9237a709ffc5bc4f
SSDEEP 96:kktMQ7VwY9+4u4fi6SbgMIh1QxB64WpsQhX/T880L6pK:nwY9+4u4a6SbJIhexLWpsQh78xL6pK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lq1tyy95tr4

Path C:\Users\Admin\AppData\Local\Temp\lq1tyy95tr4
Size 103KB
SHA256 4885a708e76e6974303ce6886538e1294e5a79a4f453747f2b92507a02f8bed9
MD5 bb643fceacf6a85acec9cbb5c75b1778
SHA1 6c9288b1f6eb1bbe1b950601fa7e249e6384acad
SHA512 bc2cbed009f1c0ee8c999343a88c1efefb2e97c07e2fc830631653b0a6c3fa1234eaa78eccd8b16907a8227c2828e594029c9ab33f425db1afeeeea02cb091dd
SSDEEP 3072:WfXMxhFy0NFGGLlud9bOyI98BJoAreTwzp:WfXMxhvNFlluOyKAreTwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/480-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/480-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/480-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads