lokibot | 1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20220414-en
submitted
09/05/2022, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
47ff8ccb6a8733906dfb61d7c03fde8c.exe
Size 157KB
Sample220509-stlfrsdfe4
SHA256 1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe
MD5 47ff8ccb6a8733906dfb61d7c03fde8c
SHA1 7a3c2b6abb8a52ee2dd313fa9c7907bbd02d97fa
SHA512 602e3e951b8efb22c92bb92b7b192ef8627bc44f428b4adb20cd74a118b487b33a0289e4abc5bc8c9e6b58fffc9dbf514990cdf2153654fdc6698c1c8781872b
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://62.197.136.176/liyan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
2004	uotzqsakj.exe
1120	uotzqsakj.exe

Loads dropped DLL 2 IoCs

pid	Process
1980	47ff8ccb6a8733906dfb61d7c03fde8c.exe
2004	uotzqsakj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uotzqsakj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	uotzqsakj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uotzqsakj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 1120	2004	uotzqsakj.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	uotzqsakj.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2004	1980	47ff8ccb6a8733906dfb61d7c03fde8c.exe	27
PID 1980 wrote to memory of 2004	1980	47ff8ccb6a8733906dfb61d7c03fde8c.exe	27
PID 1980 wrote to memory of 2004	1980	47ff8ccb6a8733906dfb61d7c03fde8c.exe	27
PID 1980 wrote to memory of 2004	1980	47ff8ccb6a8733906dfb61d7c03fde8c.exe	27
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28
PID 2004 wrote to memory of 1120	2004	uotzqsakj.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uotzqsakj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uotzqsakj.exe

C:\Users\Admin\AppData\Local\Temp\47ff8ccb6a8733906dfb61d7c03fde8c.exe
"C:\Users\Admin\AppData\Local\Temp\47ff8ccb6a8733906dfb61d7c03fde8c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
  C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe C:\Users\Admin\AppData\Local\Temp\lyehy
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
    C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe C:\Users\Admin\AppData\Local\Temp\lyehy
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ak0rtd7x3pdgc77a

Path C:\Users\Admin\AppData\Local\Temp\ak0rtd7x3pdgc77a
Size 103KB
SHA256 e7e14a79a0d7127b350ae942a2bd9782edaadf7d370b6369b4923d62d5ab3270
MD5 ea2f2d345aaef9d223f736bb75a99d8f
SHA1 4049b960fccd7df0f6e780af3d566245e7522e3d
SHA512 9eba831a11d836b1e1dfd01c9c18c1e5e6b1222d0da4bd0819bea594c536db6cc88135dbc95f7f5662f3397f22d368b175eef447f783ba02dff82772aee0e0c2
SSDEEP 3072:7NIdZ+7cD6bDO1xjLVBWRqqB6DrA8XPdNr:7Ntg6n+xBWRj4A8V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyehy

Path C:\Users\Admin\AppData\Local\Temp\lyehy
Size 5KB
SHA256 6d9201944bc93ea88e23113eb6ce97519febd248f0bb9c754539255b8e0c5d95
MD5 d405d119c8c0d904916c3580f69b805e
SHA1 d435a317146392bb94884570ff0abc14deb58f3c
SHA512 a12b659b4f73402a1c3af21baf7fc3c42e4b7392396182a19b9fcd6020380eb905bb23a3de2db0e0ef290fdc8e79f8264a355c2b1962e627a9e9fa85b7c85d0d
SSDEEP 96:xWCD5W8mP5UW9DcIeQ0dK4GXw9mbwB8t0GzpbZN/JDmWO9PhfeELAvy7eMoOgYuM:xWC0lkvowQbft0GmliH8rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path \Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path \Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1120-62-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1120-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1120-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1980-54-0x00000000768D1000-0x00000000768D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads