lokibot | 1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe

General

Target
47ff8ccb6a8733906dfb61d7c03fde8c.exe
Size 157KB
Sample220509-stlfrsdfe4
SHA256 1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe
MD5 47ff8ccb6a8733906dfb61d7c03fde8c
SHA1 7a3c2b6abb8a52ee2dd313fa9c7907bbd02d97fa
SHA512 602e3e951b8efb22c92bb92b7b192ef8627bc44f428b4adb20cd74a118b487b33a0289e4abc5bc8c9e6b58fffc9dbf514990cdf2153654fdc6698c1c8781872b
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/liyan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
5076	uotzqsakj.exe
1524	uotzqsakj.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uotzqsakj.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	uotzqsakj.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uotzqsakj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 1524	5076	uotzqsakj.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	uotzqsakj.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5076	5012	47ff8ccb6a8733906dfb61d7c03fde8c.exe	81
PID 5012 wrote to memory of 5076	5012	47ff8ccb6a8733906dfb61d7c03fde8c.exe	81
PID 5012 wrote to memory of 5076	5012	47ff8ccb6a8733906dfb61d7c03fde8c.exe	81
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82
PID 5076 wrote to memory of 1524	5076	uotzqsakj.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	uotzqsakj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	uotzqsakj.exe

C:\Users\Admin\AppData\Local\Temp\47ff8ccb6a8733906dfb61d7c03fde8c.exe
"C:\Users\Admin\AppData\Local\Temp\47ff8ccb6a8733906dfb61d7c03fde8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
  C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe C:\Users\Admin\AppData\Local\Temp\lyehy
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
    C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe C:\Users\Admin\AppData\Local\Temp\lyehy
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ak0rtd7x3pdgc77a

Path C:\Users\Admin\AppData\Local\Temp\ak0rtd7x3pdgc77a
Size 103KB
SHA256 e7e14a79a0d7127b350ae942a2bd9782edaadf7d370b6369b4923d62d5ab3270
MD5 ea2f2d345aaef9d223f736bb75a99d8f
SHA1 4049b960fccd7df0f6e780af3d566245e7522e3d
SHA512 9eba831a11d836b1e1dfd01c9c18c1e5e6b1222d0da4bd0819bea594c536db6cc88135dbc95f7f5662f3397f22d368b175eef447f783ba02dff82772aee0e0c2
SSDEEP 3072:7NIdZ+7cD6bDO1xjLVBWRqqB6DrA8XPdNr:7Ntg6n+xBWRj4A8V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyehy

Path C:\Users\Admin\AppData\Local\Temp\lyehy
Size 5KB
SHA256 6d9201944bc93ea88e23113eb6ce97519febd248f0bb9c754539255b8e0c5d95
MD5 d405d119c8c0d904916c3580f69b805e
SHA1 d435a317146392bb94884570ff0abc14deb58f3c
SHA512 a12b659b4f73402a1c3af21baf7fc3c42e4b7392396182a19b9fcd6020380eb905bb23a3de2db0e0ef290fdc8e79f8264a355c2b1962e627a9e9fa85b7c85d0d
SSDEEP 96:xWCD5W8mP5UW9DcIeQ0dK4GXw9mbwB8t0GzpbZN/JDmWO9PhfeELAvy7eMoOgYuM:xWC0lkvowQbft0GmliH8rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uotzqsakj.exe

Path C:\Users\Admin\AppData\Local\Temp\uotzqsakj.exe
Size 78KB
SHA256 37cfa67d5d45216423bb9252caac9346be96b071d5c07a468e41ce7d392f2284
MD5 0417968de848fac85582a594f533314f
SHA1 30e331e9aa5ab842a31c58727450f56708f840b3
SHA512 32264e76b4b45093752eefd9288479103f0b372c8de37a8fd94bac7a99f76d99471f17b21625154ab559a586cfb191bedbff84ff697c680b83378925b1fce307
SSDEEP 1536:YZU41PbJq1p/VNdxG6Woc/3YbgcCJccAxSpsWjcd2E6We:E1jJKVVGYc/nAQWjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1524-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1524-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1524-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads