lokibot | 8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed

General

Target

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
Size

207KB
MD5

0eb62853b63f5276c9eb21fff540c8be
SHA1

8c112916e5b8154e964bdb2c44cd4a69515619d3
SHA256

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed
SHA512

73ce830ea331ef4b387520d6754375141b179715ed028fa5b78a293f47bb9dd50c681405e6ef4f3294ea8b0798d73332aa884fe86c220a7a30fae882b8db5646

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gf25/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

ouldcbuhe.exeouldcbuhe.exe

pid process

1764 ouldcbuhe.exe
1060 ouldcbuhe.exe

pid	process
1764	ouldcbuhe.exe
1060	ouldcbuhe.exe

Loads dropped DLL 3 IoCs

Processes:

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exeouldcbuhe.exe

pid	process
452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
1764	ouldcbuhe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ouldcbuhe.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ouldcbuhe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ouldcbuhe.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ouldcbuhe.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ouldcbuhe.exe

description pid process target process

PID 1764 set thread context of 1060 1764 ouldcbuhe.exe ouldcbuhe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ouldcbuhe.exe

description pid process

Token: SeDebugPrivilege 1060 ouldcbuhe.exe

description	pid	process	target process
PID 1764 set thread context of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe

description	pid	process
Token: SeDebugPrivilege	1060	ouldcbuhe.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exeouldcbuhe.exe

description	pid	process	target process
PID 452 wrote to memory of 1764	452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 452 wrote to memory of 1764	452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 452 wrote to memory of 1764	452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 452 wrote to memory of 1764	452	8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe
PID 1764 wrote to memory of 1060	1764	ouldcbuhe.exe	ouldcbuhe.exe

outlook_office_path 1 IoCs

Processes:

ouldcbuhe.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ouldcbuhe.exe

outlook_win_path 1 IoCs

Processes:

ouldcbuhe.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ouldcbuhe.exe

C:\Users\Admin\AppData\Local\Temp\8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe
"C:\Users\Admin\AppData\Local\Temp\8b012d813f6a0022c8f129a9d55ceb4ff6e09941054c05960170b7a4a48bb2ed.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe
  C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe C:\Users\Admin\AppData\Local\Temp\dndwkg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe
    C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe C:\Users\Admin\AppData\Local\Temp\dndwkg
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\99817is36sdxqig52z

Filesize
103KB

MD5
9a06dfe3724edb2526c756e467c07b9d

SHA1
89188b43bb4c858dce4fc4cacff4774e16ea983e

SHA256
95fb4fd49fae5f806423f002a870f2b3f496ec148b11b7909a027e3d04736c58

SHA512
f29754d7d6249fd60094db388a3b3ea90f037f649bdd4fd208e35d1aaec4bb13fbe8d6679512dfb27cf3bd2e608e0364b3dd865cce958daac35388443662e50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dndwkg

Filesize
5KB

MD5
ff4c161865c5db1b65de9f3883b44b58

SHA1
ce2fca83ef23188b9c7462b94665ea99ac68b4f1

SHA256
269e6e0da1164feaf77f9b330ac448f1dfe701cefca46045fa8c6e50434000cd

SHA512
a2fe3d85e01d3d01fc69ab02070a517c1689bb95b7dee526343a178a2af8a1ead28417f38c3032d86130c88d846a0a9d99505f7e52c710a7bb24157339249094

Download Submit
C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
C:\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
\Users\Admin\AppData\Local\Temp\ouldcbuhe.exe

Filesize
133KB

MD5
2acc7c61c2a06d45637ad99ccfe6aeda

SHA1
777cfb6f3bdbfbca456ce48618a40ff50f2a29ae

SHA256
924b19e82e132170856549168b5d8cf43cd4e51363032e7a7ef92dc1ab8d938c

SHA512
918bab712925a66b16072a9a63621e776034da5ec1edbec69b46ec8b8d712ccc1290976624770a2cec043ce22fb43c231780bfbffcc55aa0033d56bc7b98a976

Download Submit
memory/452-54-0x0000000075361000-0x0000000075363000-memory.dmp

Filesize
8KB

Download
memory/1060-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1060-64-0x00000000004139DE-mapping.dmp

Download
memory/1060-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1060-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1764-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads