lokibot | 38607a8947d22efc18f27b09b0f51bd9b2dbf9c8d7b60b27bcc2449dea8ef87f

General

Target
5a526d103703d218cbbca10dbdb61bb9.exe
Size 123KB
Sample220429-jgc47aeaaq
SHA256 38607a8947d22efc18f27b09b0f51bd9b2dbf9c8d7b60b27bcc2449dea8ef87f
MD5 5a526d103703d218cbbca10dbdb61bb9
SHA1 b7c3fabd1a7d992c584363682089c597c59b09f5
SHA512 2b90f97c5818689bbf251d3d10cfc060063a86670375c9f8b9b4ca6a049214e880f8ed837e3f989f9443433bb112533c472c1e3b5a308b694bbe66e268fa5414
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
4736	qmjohq.exe
4372	qmjohq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qmjohq.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	qmjohq.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qmjohq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 4372	4736	qmjohq.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	qmjohq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4736	1560	5a526d103703d218cbbca10dbdb61bb9.exe	81
PID 1560 wrote to memory of 4736	1560	5a526d103703d218cbbca10dbdb61bb9.exe	81
PID 1560 wrote to memory of 4736	1560	5a526d103703d218cbbca10dbdb61bb9.exe	81
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82
PID 4736 wrote to memory of 4372	4736	qmjohq.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	qmjohq.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	qmjohq.exe

C:\Users\Admin\AppData\Local\Temp\5a526d103703d218cbbca10dbdb61bb9.exe
"C:\Users\Admin\AppData\Local\Temp\5a526d103703d218cbbca10dbdb61bb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\qmjohq.exe
  C:\Users\Admin\AppData\Local\Temp\qmjohq.exe C:\Users\Admin\AppData\Local\Temp\fglubk
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\qmjohq.exe
    C:\Users\Admin\AppData\Local\Temp\qmjohq.exe C:\Users\Admin\AppData\Local\Temp\fglubk
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5p2mcmpkwunv5dkvti33

Path C:\Users\Admin\AppData\Local\Temp\5p2mcmpkwunv5dkvti33
Size 103KB
SHA256 043e87448d1dc22047d0a67daa03dd3e0f6aa2b4a410e0b68a4c9f8583b4496f
MD5 84103478efbd62fb577806393ec355c6
SHA1 ab21087fcb8dfa791b06cb71c8bd0edfa69be666
SHA512 a1735d2e32afb78f826cfe95023d74d8c7b06bb88608948ae2f5bd75a899f20c947e9e61e161dddd5e4e0b7c285e712fc29c6327617efc6e4b082f25d3ca58e6
SSDEEP 1536:+d5VPpOrwrRaU85XE0SsASgs4Jd1X5Cw9HYGkW4cKZZkJqHCvr1H3WR15DeUiTK1:YMkrAfXvlws4J7Xwc5JTrd3WZiTKBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

fglubk

Path C:\Users\Admin\AppData\Local\Temp\fglubk
Size 4KB
SHA256 fb4bf8e25b08e7209e95a15df1946d72806a41bdccba1f13479d037d9a38c57a
MD5 a60a9c9176c8322e1680e8f173579f77
SHA1 6ee62b4006919b824460b5bf21e0502bc0ad332e
SHA512 ec34441f09dd8f9c7619987be8bde9b5bc6b2de105be84da3fc22d7acd5c74c8d6760158de28075a2ff0da6c9816ac422cb3860402399ac7e6e0efde60b5205c
SSDEEP 96:BKetog3poB6huPmmM7C9pFyjRJmvPekwAbvEQd4FNF/8mCZzURdj+VLfZvoWlGag:AMog3poYsmmMu9XyjVk/rEQCNFveS1+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmjohq.exe

Path C:\Users\Admin\AppData\Local\Temp\qmjohq.exe
Size 4KB
SHA256 b2a6538946eec4c4e43331167111fca512bdeadc0c95033e5ba10704d852089f
MD5 c0b0b67cb57d54804518c6437eefdf39
SHA1 4d1f3d8bb46157891ba818346cefdd514001fbd5
SHA512 adec61299409fb154b6065f22992e61bce358d0aff4ae2850b47e43bacc8c7ff474f3928e1fa79fa88c311be2415e5ea11efde6038b8eb8f778ff2702d029749
MD5 SHA1 SHA512

Submit Download

qmjohq.exe

Path C:\Users\Admin\AppData\Local\Temp\qmjohq.exe
Size 4KB
SHA256 b2a6538946eec4c4e43331167111fca512bdeadc0c95033e5ba10704d852089f
MD5 c0b0b67cb57d54804518c6437eefdf39
SHA1 4d1f3d8bb46157891ba818346cefdd514001fbd5
SHA512 adec61299409fb154b6065f22992e61bce358d0aff4ae2850b47e43bacc8c7ff474f3928e1fa79fa88c311be2415e5ea11efde6038b8eb8f778ff2702d029749
MD5 SHA1 SHA512

Submit Download

qmjohq.exe

Path C:\Users\Admin\AppData\Local\Temp\qmjohq.exe
Size 4KB
SHA256 b2a6538946eec4c4e43331167111fca512bdeadc0c95033e5ba10704d852089f
MD5 c0b0b67cb57d54804518c6437eefdf39
SHA1 4d1f3d8bb46157891ba818346cefdd514001fbd5
SHA512 adec61299409fb154b6065f22992e61bce358d0aff4ae2850b47e43bacc8c7ff474f3928e1fa79fa88c311be2415e5ea11efde6038b8eb8f778ff2702d029749
MD5 SHA1 SHA512

Submit Download

memory/4372-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4372-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4372-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads