lokibot | ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c

General

Target

ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe
Size

182KB
MD5

f850bf6bfd9be6aa4d73b6a026986c29
SHA1

9353ddfcd83b70220e68c561e25f9743bc9a6e36
SHA256

ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c
SHA512

b49367090ee142706a81eea95daa7c9dd4873fde654d53b7c819e964a2ca3b0cdd65ac30d909480d9258d270cc0d455d2b65386f84415c930648b072777b9b61

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://62.197.136.176/liyan/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

fzzdkjbal.exefzzdkjbal.exe

pid process

4300 fzzdkjbal.exe
424 fzzdkjbal.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4300	fzzdkjbal.exe
424	fzzdkjbal.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

fzzdkjbal.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fzzdkjbal.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fzzdkjbal.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	fzzdkjbal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fzzdkjbal.exe

description pid process target process

PID 4300 set thread context of 424 4300 fzzdkjbal.exe fzzdkjbal.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fzzdkjbal.exe

description pid process

Token: SeDebugPrivilege 424 fzzdkjbal.exe

description	pid	process	target process
PID 4300 set thread context of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe

description	pid	process
Token: SeDebugPrivilege	424	fzzdkjbal.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exefzzdkjbal.exe

description	pid	process	target process
PID 2596 wrote to memory of 4300	2596	ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe	fzzdkjbal.exe
PID 2596 wrote to memory of 4300	2596	ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe	fzzdkjbal.exe
PID 2596 wrote to memory of 4300	2596	ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe
PID 4300 wrote to memory of 424	4300	fzzdkjbal.exe	fzzdkjbal.exe

outlook_office_path 1 IoCs

Processes:

fzzdkjbal.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fzzdkjbal.exe

outlook_win_path 1 IoCs

Processes:

fzzdkjbal.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fzzdkjbal.exe

C:\Users\Admin\AppData\Local\Temp\ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe
"C:\Users\Admin\AppData\Local\Temp\ae518b415f4c868777f1530bd1c0f5e5562fecd562b707a112404e886d177a1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe
  C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe C:\Users\Admin\AppData\Local\Temp\ufdwwtbk
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe
    C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe C:\Users\Admin\AppData\Local\Temp\ufdwwtbk
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe

Filesize
78KB

MD5
c743cace6f27ba7f1bcebc6328f1eaa0

SHA1
430243b01cc965a462a66716fef4667c0f3bfab5

SHA256
48f7ffd102649c907b9a5d93acb2da59a2e689596849a4407664bd02f1462330

SHA512
a065964c12f12f6d3929b06d5507a2384c68e3594fd3783dbf1b3ad46a5621ff250b05efbe51df2348223cee6c602ea2f3786440de54b259f31665350f66d7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe

Filesize
78KB

MD5
c743cace6f27ba7f1bcebc6328f1eaa0

SHA1
430243b01cc965a462a66716fef4667c0f3bfab5

SHA256
48f7ffd102649c907b9a5d93acb2da59a2e689596849a4407664bd02f1462330

SHA512
a065964c12f12f6d3929b06d5507a2384c68e3594fd3783dbf1b3ad46a5621ff250b05efbe51df2348223cee6c602ea2f3786440de54b259f31665350f66d7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fzzdkjbal.exe

Filesize
78KB

MD5
c743cace6f27ba7f1bcebc6328f1eaa0

SHA1
430243b01cc965a462a66716fef4667c0f3bfab5

SHA256
48f7ffd102649c907b9a5d93acb2da59a2e689596849a4407664bd02f1462330

SHA512
a065964c12f12f6d3929b06d5507a2384c68e3594fd3783dbf1b3ad46a5621ff250b05efbe51df2348223cee6c602ea2f3786440de54b259f31665350f66d7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ufdwwtbk

Filesize
5KB

MD5
d06f56ab7ccf7602459e034ae713b8f5

SHA1
d22a98721829c94aea15219241b9c13c1459af2a

SHA256
2894b6364dbb0887178f735dbdf8059a4635613ebe054fd44d1877ea51a9065d

SHA512
c0b471abe265cb14bff42095962852392b7fbdfbfdb2f49320274bcc2b1d6d5ce1702b61bd068c067bf49d4ddb0bbb5d309ea964f631888151f61d1ab4c37eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ybh0jizvposzej

Filesize
103KB

MD5
c05593d80b1ae1398e12fa09721c6f69

SHA1
54e4f63e677927cb458b7d65961da212276aac0b

SHA256
ee5b3e91c8da304aeb275821536829792e5d7e92b85c63ac38c67e6d5f0f43b1

SHA512
fcc74a1b18f4ba725bafe0f434b2a0f011869961c9566471cd4ff31d25871fac89c009f00de67dc9cb9d9c18d27664a19ff855faba61e150dcda6b849eb646f5

Download Submit
memory/424-135-0x0000000000000000-mapping.dmp

Download
memory/424-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/424-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/424-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4300-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads