lokibot | bb36f0ab95d6422a20e81221adeb4033ebdbd7b20337a2557f3f5c3de0a77596

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20220414-en
submitted
04/05/2022, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c5d4e3e0dadff03da7b9878acf3e706.exe
Size 122KB
Sample220504-sb6c8agham
SHA256 bb36f0ab95d6422a20e81221adeb4033ebdbd7b20337a2557f3f5c3de0a77596
MD5 5c5d4e3e0dadff03da7b9878acf3e706
SHA1 38a387d18c147245078db39a82f8531816c9d726
SHA512 073194f0f86af4ca4721b3d7ea7e78755b90e1c8e85e27c969f0407a4ab78bf0af153177e96e583d952c9dacb6cc7b7a0071eabc80ff015b5f209a9b668ff2c4
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://sempersim.su/gf3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1920	dehbibhar.exe
1680	dehbibhar.exe

Loads dropped DLL 2 IoCs

pid	Process
1684	5c5d4e3e0dadff03da7b9878acf3e706.exe
1920	dehbibhar.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dehbibhar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dehbibhar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dehbibhar.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 1680	1920	dehbibhar.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	dehbibhar.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	27
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	27
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	27
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	27
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dehbibhar.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dehbibhar.exe

C:\Users\Admin\AppData\Local\Temp\5c5d4e3e0dadff03da7b9878acf3e706.exe
"C:\Users\Admin\AppData\Local\Temp\5c5d4e3e0dadff03da7b9878acf3e706.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
  C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe C:\Users\Admin\AppData\Local\Temp\efnvpl
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
    C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe C:\Users\Admin\AppData\Local\Temp\efnvpl
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dehbibhar.exe

Path C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Size 4KB
SHA256 a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014
MD5 99df91cf3e9775be40fe27fefa10c203
SHA1 dbda94e51f0f783e4c169d2d838d3377550450ac
SHA512 d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d
MD5 SHA1 SHA512

Submit Download

dehbibhar.exe

Path C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Size 4KB
SHA256 a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014
MD5 99df91cf3e9775be40fe27fefa10c203
SHA1 dbda94e51f0f783e4c169d2d838d3377550450ac
SHA512 d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d
MD5 SHA1 SHA512

Submit Download

dehbibhar.exe

Path C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Size 4KB
SHA256 a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014
MD5 99df91cf3e9775be40fe27fefa10c203
SHA1 dbda94e51f0f783e4c169d2d838d3377550450ac
SHA512 d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d
MD5 SHA1 SHA512

Submit Download

efnvpl

Path C:\Users\Admin\AppData\Local\Temp\efnvpl
Size 4KB
SHA256 07a69d2284b659076040725425497d4da10adb891a5f3d54a10c707d2a74fb01
MD5 e2ffabc730a2cf170a16934f49e1b05e
SHA1 09299351820381199c6cee30062dfc5be0a3e9a6
SHA512 cfd2709345ee7d1de087a3d46cf418f96ee347c1a37579608b84bd00747fcecc2d148a65cf7c879837dcec9e58f3ee2d2c2d31b534b9e4174f2a57c17c99bf14
SSDEEP 96:Fp8h7t+r4zx4jrGP0VqcfWKcirH1BAbK6S6DWZlBy9FWGPZNQB2jK4CsBDL1:+tA4zx4jywfTOXUBKQ4XCstL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ptq0vlz6htg

Path C:\Users\Admin\AppData\Local\Temp\ptq0vlz6htg
Size 103KB
SHA256 92336a96341d13c5b45a82ee508a85eae3c907ddf9e2c62dd99f5db2ca59d9ce
MD5 92b8f8d79d15063fe55f13d98069fd80
SHA1 46ea07994665e3560a6fe9b38483d47b8527b6dd
SHA512 96b1e4feb23da9b0711bceb637cf3de80c9f62592bd673e4a83e20f5dbd15f225d40fe0d9624b0ed029ea1afa46c167e03c7cede27bcbf7d51b146481450267c
SSDEEP 1536:hYYUu04hEOBzupNyyKiYjPFvrNHzNwZWOzLqJW0bvivVEPq80H46I:hYYVhEO+AFvlSkOzuJDudEy/H+
MD5 SHA1 SHA512 SSDEEP

Submit Download

dehbibhar.exe

Path \Users\Admin\AppData\Local\Temp\dehbibhar.exe
Size 4KB
SHA256 a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014
MD5 99df91cf3e9775be40fe27fefa10c203
SHA1 dbda94e51f0f783e4c169d2d838d3377550450ac
SHA512 d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d
MD5 SHA1 SHA512

Submit Download

dehbibhar.exe

Path \Users\Admin\AppData\Local\Temp\dehbibhar.exe
Size 4KB
SHA256 a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014
MD5 99df91cf3e9775be40fe27fefa10c203
SHA1 dbda94e51f0f783e4c169d2d838d3377550450ac
SHA512 d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d
MD5 SHA1 SHA512

Submit Download

memory/1680-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1680-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1680-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1684-54-0x00000000752D1000-0x00000000752D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads