lokibot | a7ee299c6804573312fb3e6bd3d8b196517608c42f310cfd0bcec25eaffb18f1

General

Target
4473eb51a6f6dc99f1a66bbfcc9a72fc.exe
Size 123KB
Sample220504-jldlhsdde8
SHA256 a7ee299c6804573312fb3e6bd3d8b196517608c42f310cfd0bcec25eaffb18f1
MD5 4473eb51a6f6dc99f1a66bbfcc9a72fc
SHA1 710111969aba5ae7b1061f16157d46855e887ac7
SHA512 201021977e6b837f20987e4ad99cedcedae99f639054916d333edf4a932c142fb2a30609a0623e7ace481cfd4ec2a45119b62479b96ff86b56cbfccb64b437f5
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/liyan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
2964	iexpimft.exe
4216	iexpimft.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	iexpimft.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	iexpimft.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	iexpimft.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 4216	2964	iexpimft.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	iexpimft.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2964	3932	4473eb51a6f6dc99f1a66bbfcc9a72fc.exe	81
PID 3932 wrote to memory of 2964	3932	4473eb51a6f6dc99f1a66bbfcc9a72fc.exe	81
PID 3932 wrote to memory of 2964	3932	4473eb51a6f6dc99f1a66bbfcc9a72fc.exe	81
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82
PID 2964 wrote to memory of 4216	2964	iexpimft.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	iexpimft.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	iexpimft.exe

C:\Users\Admin\AppData\Local\Temp\4473eb51a6f6dc99f1a66bbfcc9a72fc.exe
"C:\Users\Admin\AppData\Local\Temp\4473eb51a6f6dc99f1a66bbfcc9a72fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\iexpimft.exe
  C:\Users\Admin\AppData\Local\Temp\iexpimft.exe C:\Users\Admin\AppData\Local\Temp\gooseejtx
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\iexpimft.exe
    C:\Users\Admin\AppData\Local\Temp\iexpimft.exe C:\Users\Admin\AppData\Local\Temp\gooseejtx
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gooseejtx

Path C:\Users\Admin\AppData\Local\Temp\gooseejtx
Size 5KB
SHA256 fa863d5c0f3dc57e87c8915a176845cb4a316b42e034dec947306f481ea76baa
MD5 79d6d00b068e015174fad6920013d82a
SHA1 cf31243a5ee1acb2c63d7f13bab55a4a8e2597f1
SHA512 e2a1ce33ce921627377d9c603596a8f9d5b24001ba73c6b2daad1045e83792529d1f4fd4182abaecf7890b9465fa68d738d07959f9b8c9c38c077c6b9974e05d
SSDEEP 96:HX87iWgcdrcRvCBejE0cuqyTojT4Rn3lT47W/Y0:HSglKBfyWjTC3lTIW/Y0
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexpimft.exe

Path C:\Users\Admin\AppData\Local\Temp\iexpimft.exe
Size 5KB
SHA256 ff22d46135d75dc4e049a167e2a73a09f8c60a45eb93265adf2f4feb4a69dfab
MD5 da56fae9f0a29ca4c8a7eb26b82b2bf2
SHA1 fe223242472966acf588b036efd9ff623ebea3a1
SHA512 e15972ff62f1c3f975b6a36544a2787053cab43266ac66e4d93aedfebd919a0f876737075795f319a8773c295616b71113e4b604aa8e3164f87e2f4147f7c8ee
SSDEEP 48:Sp9QcpaOF5TvctGQLghcQcQks+j8Z+hRP2bv0D4LS0MK0w/fcefhrRVRuqS:UA8gtGugahHa2K0w/ke5rpx
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexpimft.exe

Path C:\Users\Admin\AppData\Local\Temp\iexpimft.exe
Size 5KB
SHA256 ff22d46135d75dc4e049a167e2a73a09f8c60a45eb93265adf2f4feb4a69dfab
MD5 da56fae9f0a29ca4c8a7eb26b82b2bf2
SHA1 fe223242472966acf588b036efd9ff623ebea3a1
SHA512 e15972ff62f1c3f975b6a36544a2787053cab43266ac66e4d93aedfebd919a0f876737075795f319a8773c295616b71113e4b604aa8e3164f87e2f4147f7c8ee
SSDEEP 48:Sp9QcpaOF5TvctGQLghcQcQks+j8Z+hRP2bv0D4LS0MK0w/fcefhrRVRuqS:UA8gtGugahHa2K0w/ke5rpx
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexpimft.exe

Path C:\Users\Admin\AppData\Local\Temp\iexpimft.exe
Size 5KB
SHA256 ff22d46135d75dc4e049a167e2a73a09f8c60a45eb93265adf2f4feb4a69dfab
MD5 da56fae9f0a29ca4c8a7eb26b82b2bf2
SHA1 fe223242472966acf588b036efd9ff623ebea3a1
SHA512 e15972ff62f1c3f975b6a36544a2787053cab43266ac66e4d93aedfebd919a0f876737075795f319a8773c295616b71113e4b604aa8e3164f87e2f4147f7c8ee
SSDEEP 48:Sp9QcpaOF5TvctGQLghcQcQks+j8Z+hRP2bv0D4LS0MK0w/fcefhrRVRuqS:UA8gtGugahHa2K0w/ke5rpx
MD5 SHA1 SHA512 SSDEEP

Submit Download

p9i8auyaaky

Path C:\Users\Admin\AppData\Local\Temp\p9i8auyaaky
Size 103KB
SHA256 3e2bba58c04e4efc46424a9f3d8c0e146f6798a8ae0d2cdd3a9fe70af387dc64
MD5 534e7ff89224c51650eb26216ecc7604
SHA1 4cece4e1e625918df2411b4018c93feb2483a372
SHA512 787a1389ebdb5293bca4a5d851096c1a57974ca3618dcf38e6fff2290ed9ead14c2f7687f691a6f5490a8585c6f566f710efc5d1ce62edb22239bbc05fcee86b
SSDEEP 3072:Vnd795OEEvoj95tjCoTaMTheT8pvrmDt7x:VP5OrvoztDaYYTLZ7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4216-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4216-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4216-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads