lokibot | bb36f0ab95d6422a20e81221adeb4033ebdbd7b20337a2557f3f5c3de0a77596

General

Target

5c5d4e3e0dadff03da7b9878acf3e706.exe
Size

122KB
MD5

5c5d4e3e0dadff03da7b9878acf3e706
SHA1

38a387d18c147245078db39a82f8531816c9d726
SHA256

bb36f0ab95d6422a20e81221adeb4033ebdbd7b20337a2557f3f5c3de0a77596
SHA512

073194f0f86af4ca4721b3d7ea7e78755b90e1c8e85e27c969f0407a4ab78bf0af153177e96e583d952c9dacb6cc7b7a0071eabc80ff015b5f209a9b668ff2c4

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gf3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

dehbibhar.exedehbibhar.exe

pid process

1920 dehbibhar.exe
1680 dehbibhar.exe
Loads dropped DLL 2 IoCs

Processes:

5c5d4e3e0dadff03da7b9878acf3e706.exedehbibhar.exe

pid process

1684 5c5d4e3e0dadff03da7b9878acf3e706.exe
1920 dehbibhar.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1920	dehbibhar.exe
1680	dehbibhar.exe

pid	process
1684	5c5d4e3e0dadff03da7b9878acf3e706.exe
1920	dehbibhar.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

dehbibhar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dehbibhar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dehbibhar.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dehbibhar.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dehbibhar.exe

description pid process target process

PID 1920 set thread context of 1680 1920 dehbibhar.exe dehbibhar.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dehbibhar.exe

description pid process

Token: SeDebugPrivilege 1680 dehbibhar.exe

description	pid	process	target process
PID 1920 set thread context of 1680	1920	dehbibhar.exe	dehbibhar.exe

description	pid	process
Token: SeDebugPrivilege	1680	dehbibhar.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5c5d4e3e0dadff03da7b9878acf3e706.exedehbibhar.exe

description	pid	process	target process
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	dehbibhar.exe
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	dehbibhar.exe
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	dehbibhar.exe
PID 1684 wrote to memory of 1920	1684	5c5d4e3e0dadff03da7b9878acf3e706.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe
PID 1920 wrote to memory of 1680	1920	dehbibhar.exe	dehbibhar.exe

outlook_office_path 1 IoCs

Processes:

dehbibhar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dehbibhar.exe

outlook_win_path 1 IoCs

Processes:

dehbibhar.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dehbibhar.exe

C:\Users\Admin\AppData\Local\Temp\5c5d4e3e0dadff03da7b9878acf3e706.exe
"C:\Users\Admin\AppData\Local\Temp\5c5d4e3e0dadff03da7b9878acf3e706.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe C:\Users\Admin\AppData\Local\Temp\efnvpl
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe C:\Users\Admin\AppData\Local\Temp\efnvpl
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Filesize
4KB

MD5
99df91cf3e9775be40fe27fefa10c203

SHA1
dbda94e51f0f783e4c169d2d838d3377550450ac

SHA256
a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014

SHA512
d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Filesize
4KB

MD5
99df91cf3e9775be40fe27fefa10c203

SHA1
dbda94e51f0f783e4c169d2d838d3377550450ac

SHA256
a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014

SHA512
d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Filesize
4KB

MD5
99df91cf3e9775be40fe27fefa10c203

SHA1
dbda94e51f0f783e4c169d2d838d3377550450ac

SHA256
a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014

SHA512
d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\efnvpl
Filesize
4KB

MD5
e2ffabc730a2cf170a16934f49e1b05e

SHA1
09299351820381199c6cee30062dfc5be0a3e9a6

SHA256
07a69d2284b659076040725425497d4da10adb891a5f3d54a10c707d2a74fb01

SHA512
cfd2709345ee7d1de087a3d46cf418f96ee347c1a37579608b84bd00747fcecc2d148a65cf7c879837dcec9e58f3ee2d2c2d31b534b9e4174f2a57c17c99bf14

Download Submit
C:\Users\Admin\AppData\Local\Temp\ptq0vlz6htg
Filesize
103KB

MD5
92b8f8d79d15063fe55f13d98069fd80

SHA1
46ea07994665e3560a6fe9b38483d47b8527b6dd

SHA256
92336a96341d13c5b45a82ee508a85eae3c907ddf9e2c62dd99f5db2ca59d9ce

SHA512
96b1e4feb23da9b0711bceb637cf3de80c9f62592bd673e4a83e20f5dbd15f225d40fe0d9624b0ed029ea1afa46c167e03c7cede27bcbf7d51b146481450267c

Download Submit
\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Filesize
4KB

MD5
99df91cf3e9775be40fe27fefa10c203

SHA1
dbda94e51f0f783e4c169d2d838d3377550450ac

SHA256
a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014

SHA512
d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d

Download Submit
\Users\Admin\AppData\Local\Temp\dehbibhar.exe
Filesize
4KB

MD5
99df91cf3e9775be40fe27fefa10c203

SHA1
dbda94e51f0f783e4c169d2d838d3377550450ac

SHA256
a2fc8b5ddf220b7d9df0e7fcc88f2eba533698f3d178af97a93788b614c64014

SHA512
d7abd84314dcdcfeb42f230f901a7b5da49ead7d1f85f1af34cc55d5a69278f1a7bf39bf08e92b22e81f50a8e0370705c709e550f1de794095313debd2ba7f2d

Download Submit
memory/1680-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1680-64-0x00000000004139DE-mapping.dmp

Download
memory/1680-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1680-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1684-54-0x00000000752D1000-0x00000000752D3000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads