lokibot | 4d05ed5d5deea64d74e00dd818f36afe2b7fa7effe971cab1aed950cc1976871

General

Target
8fd789dd2cb93be5bcc0cc555e3d0224.exe
Size 155KB
Sample220509-stlfrsdfe5
SHA256 4d05ed5d5deea64d74e00dd818f36afe2b7fa7effe971cab1aed950cc1976871
MD5 8fd789dd2cb93be5bcc0cc555e3d0224
SHA1 222c6e707d04977c854d286962da08fd7e5bd688
SHA512 263173f52e8bc6ae4265afc3fb60d502907d11267dbbabef4502b74b252680a2b2d6ee2bcbca3e6a1dbf6add3dc5fe7643d58624399f81968b182338cc3cde76
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
4564	smeoe.exe
3040	smeoe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	smeoe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	smeoe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	smeoe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5B6B5801-5A67-4522-AABE-2E126FBE2FA8}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{622707D5-A3DB-4AD0-B0E4-BBE0041BC067}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 3040	4564	smeoe.exe	76

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	smeoe.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4564	4120	8fd789dd2cb93be5bcc0cc555e3d0224.exe	75
PID 4120 wrote to memory of 4564	4120	8fd789dd2cb93be5bcc0cc555e3d0224.exe	75
PID 4120 wrote to memory of 4564	4120	8fd789dd2cb93be5bcc0cc555e3d0224.exe	75
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76
PID 4564 wrote to memory of 3040	4564	smeoe.exe	76

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	smeoe.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	smeoe.exe

C:\Users\Admin\AppData\Local\Temp\8fd789dd2cb93be5bcc0cc555e3d0224.exe
"C:\Users\Admin\AppData\Local\Temp\8fd789dd2cb93be5bcc0cc555e3d0224.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\smeoe.exe
  C:\Users\Admin\AppData\Local\Temp\smeoe.exe C:\Users\Admin\AppData\Local\Temp\hgdwuoza
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\smeoe.exe
    C:\Users\Admin\AppData\Local\Temp\smeoe.exe C:\Users\Admin\AppData\Local\Temp\hgdwuoza
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hgdwuoza

Path C:\Users\Admin\AppData\Local\Temp\hgdwuoza
Size 4KB
SHA256 75f7571b0a5f6de9136b9a9bb072e8d4f933bdd1cdf5f5a126cffbaebdfdd4ae
MD5 5e2b073358e944f8683efa5a23ad46a6
SHA1 e202823348f494c0dffccdc2bd35cc90ed1dc707
SHA512 0e455d2fbf57b85661d01d9a49aa4f88d5e199dba0d7183d291058a4d99bd25b6e35791b5bd8992727fc336d17ccc2d4d8a38801fb9232a3779eb1b809c58b2d
SSDEEP 96:kWEcTf3RAdFpwzB3nPp8X2UvAf9JU8FYxpprDlCPLtVucKNb/ud:n4XwzBfp8dKmphl+LUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

smeoe.exe

Path C:\Users\Admin\AppData\Local\Temp\smeoe.exe
Size 75KB
SHA256 e45c9bf36710a318f788c208bf6d106061f6f0e90e3a39ba331cf28995df83c7
MD5 5b70aa9e05b27af543263b2d9124d1ec
SHA1 0285299576663791efb76d483fc2dfa87fc59887
SHA512 d13dbb2b7683739f87f708a2919628ddb0d306b52e7ccbfcd45e3de62d7dcda2f3fcbf628f55ef47076837bbacd76ddad576dcba67cd00e7587dbb030cf794b9
SSDEEP 1536:tlsdaNv9qhHWHDexbXwzQVehuG3YbgsH+5cc3MDsWjcdIw:T90CDW6ugvhcsIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

smeoe.exe

Path C:\Users\Admin\AppData\Local\Temp\smeoe.exe
Size 75KB
SHA256 e45c9bf36710a318f788c208bf6d106061f6f0e90e3a39ba331cf28995df83c7
MD5 5b70aa9e05b27af543263b2d9124d1ec
SHA1 0285299576663791efb76d483fc2dfa87fc59887
SHA512 d13dbb2b7683739f87f708a2919628ddb0d306b52e7ccbfcd45e3de62d7dcda2f3fcbf628f55ef47076837bbacd76ddad576dcba67cd00e7587dbb030cf794b9
SSDEEP 1536:tlsdaNv9qhHWHDexbXwzQVehuG3YbgsH+5cc3MDsWjcdIw:T90CDW6ugvhcsIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

smeoe.exe

Path C:\Users\Admin\AppData\Local\Temp\smeoe.exe
Size 75KB
SHA256 e45c9bf36710a318f788c208bf6d106061f6f0e90e3a39ba331cf28995df83c7
MD5 5b70aa9e05b27af543263b2d9124d1ec
SHA1 0285299576663791efb76d483fc2dfa87fc59887
SHA512 d13dbb2b7683739f87f708a2919628ddb0d306b52e7ccbfcd45e3de62d7dcda2f3fcbf628f55ef47076837bbacd76ddad576dcba67cd00e7587dbb030cf794b9
SSDEEP 1536:tlsdaNv9qhHWHDexbXwzQVehuG3YbgsH+5cc3MDsWjcdIw:T90CDW6ugvhcsIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wyb77ex6f0eo1jv8

Path C:\Users\Admin\AppData\Local\Temp\wyb77ex6f0eo1jv8
Size 103KB
SHA256 be39098f409f072a11516a12de8d63bf4855fd89dd64b27c3df9ddf61ffbf032
MD5 1558f6fddafe81bc9e125cc076965e14
SHA1 0746956f9d77d4e236533ef385ceeb9f064374bb
SHA512 6c6287bd5d2b89388e40e2f3b5770f5aa655fca3664ee4a2059b8397a434c47e250f6de8a354146f483e97e1c03041ff19cc3be69df03bf29c24bf50c32c012d
SSDEEP 3072:h3fEW9psRVYbwNSG+w22RaXigv0VLJ0XWC:pNsjYbfGB8iVsd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3040-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3040-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3040-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads