lokibot | 2559470d892d939b0df177b1613313cc1b2bced2a17cda536de05d0c02e09d20

General

Target
0ebf139feb9dd170366c73d1d7a6c3b9.exe
Size 123KB
Sample220505-mlhf9afgd9
SHA256 2559470d892d939b0df177b1613313cc1b2bced2a17cda536de05d0c02e09d20
MD5 0ebf139feb9dd170366c73d1d7a6c3b9
SHA1 c68443e242e7ff84b5711c531eada1d073c8c9a3
SHA512 f26ed8402f0cc5c9ebcf806ac652198882641a4a7dc95c2429b1ebb4debe0869f347c3496792bd070712e4b1a68f7d1836a9e3fb22e3386d561289aa40ece34d
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/liyan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
4364	sdaguztml.exe
2312	sdaguztml.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sdaguztml.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	sdaguztml.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	sdaguztml.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4364 set thread context of 2312	4364	sdaguztml.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	sdaguztml.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4364	1428	0ebf139feb9dd170366c73d1d7a6c3b9.exe	83
PID 1428 wrote to memory of 4364	1428	0ebf139feb9dd170366c73d1d7a6c3b9.exe	83
PID 1428 wrote to memory of 4364	1428	0ebf139feb9dd170366c73d1d7a6c3b9.exe	83
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84
PID 4364 wrote to memory of 2312	4364	sdaguztml.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	sdaguztml.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	sdaguztml.exe

C:\Users\Admin\AppData\Local\Temp\0ebf139feb9dd170366c73d1d7a6c3b9.exe
"C:\Users\Admin\AppData\Local\Temp\0ebf139feb9dd170366c73d1d7a6c3b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe
  C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe C:\Users\Admin\AppData\Local\Temp\jekvkbzvd
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe
    C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe C:\Users\Admin\AppData\Local\Temp\jekvkbzvd
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jekvkbzvd

Path C:\Users\Admin\AppData\Local\Temp\jekvkbzvd
Size 4KB
SHA256 8307f0cda17db6e6ba3df91095ffc55a329e852687450af41461a13be405352f
MD5 4a331f1474ee1d0e64d8f456bfc8abb6
SHA1 52844c1a3c310b4573ca4753a3172c479cfdc458
SHA512 c141bff64fe331422c8ff1423aa5866cc193e092b2ff26ae468ba0823b46a7bb1e8327faf9021f11f9450efa7626d51992da8387153234725245105e5ee08b34
SSDEEP 96:4j+BGR/4quLqwceTLS+roQMevX+kiQa88gvK/dmBO+6XpieYKo:fBW4qkdxgQMs+kz8gS/dmB165/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt87hln8a4yqpbmuj2m

Path C:\Users\Admin\AppData\Local\Temp\rt87hln8a4yqpbmuj2m
Size 103KB
SHA256 ede4accb973b5976d2fbf141f379709a99c76611960e242373895859f9e234ab
MD5 0296d9642e12951c9e97b197e20ad71d
SHA1 f29b5fe51669f9c1d0512c9c0174736d573c8656
SHA512 f7bff94457c192002223c5c558b1fb1974377f306fdc434c50cf0e999c0fd064c5f2fe74996cee874c42d25882849ce7365a58cc13c90b0d86a5085f7761a421
SSDEEP 3072:D4wZ75yEdHKa5eKPmmvAjmWUS9qnrcpCBC:8S75T1m+LPnrLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdaguztml.exe

Path C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe
Size 5KB
SHA256 ece7f3df4d707e11b267116051e39b8eb4afa6c15d302992a1aca108049f35fb
MD5 12dc797cac18317bb5f33344d39ea401
SHA1 5923210594ecd9462858444d63201219e52e116c
SHA512 d36126c626c308b813584939fcfefb7876bdd0fe884707aea0500063d41b2995de5cf9a721d47dd1f549ba388c430301e631aea0fd3c651436352e1dfc79668f
SSDEEP 96:X5xNhGYXbFCrK+MlFgx+MeBZtXIpXSdOWPmoynsx:X5xNYYXMW74eBZVIpidPPmoyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdaguztml.exe

Path C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe
Size 5KB
SHA256 ece7f3df4d707e11b267116051e39b8eb4afa6c15d302992a1aca108049f35fb
MD5 12dc797cac18317bb5f33344d39ea401
SHA1 5923210594ecd9462858444d63201219e52e116c
SHA512 d36126c626c308b813584939fcfefb7876bdd0fe884707aea0500063d41b2995de5cf9a721d47dd1f549ba388c430301e631aea0fd3c651436352e1dfc79668f
SSDEEP 96:X5xNhGYXbFCrK+MlFgx+MeBZtXIpXSdOWPmoynsx:X5xNYYXMW74eBZVIpidPPmoyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdaguztml.exe

Path C:\Users\Admin\AppData\Local\Temp\sdaguztml.exe
Size 5KB
SHA256 ece7f3df4d707e11b267116051e39b8eb4afa6c15d302992a1aca108049f35fb
MD5 12dc797cac18317bb5f33344d39ea401
SHA1 5923210594ecd9462858444d63201219e52e116c
SHA512 d36126c626c308b813584939fcfefb7876bdd0fe884707aea0500063d41b2995de5cf9a721d47dd1f549ba388c430301e631aea0fd3c651436352e1dfc79668f
SSDEEP 96:X5xNhGYXbFCrK+MlFgx+MeBZtXIpXSdOWPmoynsx:X5xNYYXMW74eBZVIpidPPmoyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2312-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2312-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2312-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads