lokibot | 3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/05/2022, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Jaik.72878.27733.exe
Size 179KB
Sample220511-py2f1agdh7
SHA256 3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512
MD5 cab12c2b8f5a1b841b3a5434def747bf
SHA1 9cd5b29581dd8062ac3f46d118d4280c15d75aa7
SHA512 731640fe1c463ed73fff817ad61b99505eefa0bcb190d6d525576c04848dd53b54c3e96c8e2031df3ab62c7a7f0e4689a282d23eb45973347b99ccdf1c27a505
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

http://198.187.30.47/p.php?id=14615576436798928
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1760	npgyood.exe
1060	npgyood.exe

Loads dropped DLL 3 IoCs

pid	Process
1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe
1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe
1760	npgyood.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	npgyood.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	npgyood.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	npgyood.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 1060	1760	npgyood.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	npgyood.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1760	1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe	28
PID 1376 wrote to memory of 1760	1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe	28
PID 1376 wrote to memory of 1760	1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe	28
PID 1376 wrote to memory of 1760	1376	SecuriteInfo.com.Variant.Jaik.72878.27733.exe	28
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29
PID 1760 wrote to memory of 1060	1760	npgyood.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	npgyood.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	npgyood.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.72878.27733.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Jaik.72878.27733.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\npgyood.exe
  C:\Users\Admin\AppData\Local\Temp\npgyood.exe C:\Users\Admin\AppData\Local\Temp\nyvtswlm
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\npgyood.exe
    C:\Users\Admin\AppData\Local\Temp\npgyood.exe C:\Users\Admin\AppData\Local\Temp\nyvtswlm
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lhvuou84m711cc2w

Path C:\Users\Admin\AppData\Local\Temp\lhvuou84m711cc2w
Size 103KB
SHA256 46668d893e4c69dc827d5a4bd3a90bf0f3495109ca801485a8aab1d8ec8e6fce
MD5 fd474cf94fdd4a8dbe493f359de6c462
SHA1 479f075924a33b24deae668687a4f796d0d1a717
SHA512 97dfc107c6c20139c3a446a7333d09dac17543f93b9b63f80145a535b3699969671e9c348ce5d677cce84158f1c3ad174c39be66d5a1818325551e0c4b9f8b14
SSDEEP 3072:OLiyRoNXg4KWcJ4jv5hQffnISbH/zi1eKBwW1Ej:OeyRu0J4jv8tbfe1PCW1Ej
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

nyvtswlm

Path C:\Users\Admin\AppData\Local\Temp\nyvtswlm
Size 5KB
SHA256 66ac4cf9d4a2fa25193eada60f9ee2550c981525156a5ef00e42127670b89466
MD5 23cdded277028c18f674da015f72b9a9
SHA1 6494d95a79b3156fa77962a580389e7eef4bb281
SHA512 066dcabaf6563f58d764e5cb0917850e1a7813e8b21f49b653846292c4f3533f48b8d273704cb6201fe3e466a23a346e78d84979261d705ca11c1fc4110347c1
SSDEEP 96:p1NnmdeBbJdBgQzSS2YMf4y4664hqaHJi3SP6xgFmDt/6d9XMVgJymYA:p/mdYd+Ff4Y64hqaHJi3SP0gEt/gV5EO
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path \Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path \Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

npgyood.exe

Path \Users\Admin\AppData\Local\Temp\npgyood.exe
Size 74KB
SHA256 58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4
MD5 0764c7cd2b5854386a5b6e52f9b73887
SHA1 570eb66a65dadccf4b776a5a90fafd1a459dad1e
SHA512 0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd
SSDEEP 1536:rhKTKDMIbzB39RoZdGuF8QaccfXdasWjcdIU3:QTy/bV3X0GPPdFIU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1060-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1060-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1060-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1376-54-0x0000000075361000-0x0000000075363000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads