lokibot | 21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1

General

Target

21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe
Size

178KB
MD5

0707fdefc009742f2b71bd74f94f541b
SHA1

97f281579aef9feb7f7f13f08d12add1004b05c7
SHA256

21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1
SHA512

096b0163a41f8ea6562b0df3f4fd9c4e73511d6f255000155897fd072d3edb76367161703483406ffbaf92b8329aba54af99248a2b3fae44ed69a2b8011c7d5f

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

vvsawmgi.exevvsawmgi.exe

pid process

952 vvsawmgi.exe
1508 vvsawmgi.exe

pid	process
952	vvsawmgi.exe
1508	vvsawmgi.exe

Loads dropped DLL 3 IoCs

Processes:

21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exevvsawmgi.exe

pid	process
896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe
896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe
952	vvsawmgi.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vvsawmgi.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vvsawmgi.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vvsawmgi.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vvsawmgi.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vvsawmgi.exe

description pid process target process

PID 952 set thread context of 1508 952 vvsawmgi.exe vvsawmgi.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vvsawmgi.exe

description pid process

Token: SeDebugPrivilege 1508 vvsawmgi.exe

description	pid	process	target process
PID 952 set thread context of 1508	952	vvsawmgi.exe	vvsawmgi.exe

description	pid	process
Token: SeDebugPrivilege	1508	vvsawmgi.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exevvsawmgi.exe

description	pid	process	target process
PID 896 wrote to memory of 952	896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe	vvsawmgi.exe
PID 896 wrote to memory of 952	896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe	vvsawmgi.exe
PID 896 wrote to memory of 952	896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe	vvsawmgi.exe
PID 896 wrote to memory of 952	896	21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe
PID 952 wrote to memory of 1508	952	vvsawmgi.exe	vvsawmgi.exe

outlook_office_path 1 IoCs

Processes:

vvsawmgi.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	vvsawmgi.exe

outlook_win_path 1 IoCs

Processes:

vvsawmgi.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vvsawmgi.exe

C:\Users\Admin\AppData\Local\Temp\21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe
"C:\Users\Admin\AppData\Local\Temp\21250461884af7cdce99729c8ea5fe2aaaa1250b715a9c26899a97d9e05829f1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe
  C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe C:\Users\Admin\AppData\Local\Temp\ypeaokagyq
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe
    C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe C:\Users\Admin\AppData\Local\Temp\ypeaokagyq
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ebupkcnonmjf69

Filesize
103KB

MD5
04f3a81121a4b5b8e9b2f3ba3029fccf

SHA1
865109fc860722a0d5d4492e5d09604af3d9447f

SHA256
9667e167ce3ed2504f44634a58817dfa14e76f9490013ac151ea3a690d8f1587

SHA512
21ef073b390354c446082a333dc01850f13ed8890e2790a90ad1f750c183e0e9b120f4ddce0f0badabb27b6751e8e01fd200d70a5da4e2804d6d20c419120d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
C:\Users\Admin\AppData\Local\Temp\ypeaokagyq

Filesize
4KB

MD5
980c57f4546c39a2b00eff9123786333

SHA1
18df4a3bbdb3d3ac8208dd56583b750bba747581

SHA256
c0029da8552f07f3848c8fde441dcbdcf712f4d93e319b63cf9ef672347dd9ec

SHA512
e7e5fb51665637f85b3f802369373ca3bfd14af4984a1cd94d1a9f5f291dc58cf285923fa05fd7db57c036e70b0d839e12a2436293dd9f4dfe7ee376161b64bc

Download Submit
\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
\Users\Admin\AppData\Local\Temp\vvsawmgi.exe

Filesize
74KB

MD5
aacd92b544a024d6249d9fd7a7cc69a5

SHA1
46be9988221744683a9ad75fb158a7034ab66a63

SHA256
bf419cdf31730d7a8b317b5842a463095326348cad55d96b5fa6f546949b40db

SHA512
e5d6ee43bb68b4050d7f853e00bda779f65a733bdbdd5e6d9d95f0dd332ff7b342bd19868e385be5284d446a956bade4e03b8843f9f8ee25cc17575b50818780

Download Submit
memory/896-54-0x0000000074E91000-0x0000000074E93000-memory.dmp

Filesize
8KB

Download
memory/952-57-0x0000000000000000-mapping.dmp

Download
memory/1508-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1508-65-0x00000000004139DE-mapping.dmp

Download
memory/1508-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1508-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads