lokibot | 3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512

General

Target

3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe
Size

179KB
MD5

cab12c2b8f5a1b841b3a5434def747bf
SHA1

9cd5b29581dd8062ac3f46d118d4280c15d75aa7
SHA256

3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512
SHA512

731640fe1c463ed73fff817ad61b99505eefa0bcb190d6d525576c04848dd53b54c3e96c8e2031df3ab62c7a7f0e4689a282d23eb45973347b99ccdf1c27a505

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=14615576436798928

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

npgyood.exenpgyood.exe

pid process

1304 npgyood.exe
1720 npgyood.exe

pid	process
1304	npgyood.exe
1720	npgyood.exe

Loads dropped DLL 3 IoCs

Processes:

3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exenpgyood.exe

pid	process
844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe
844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe
1304	npgyood.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

npgyood.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	npgyood.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	npgyood.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	npgyood.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

npgyood.exe

description pid process target process

PID 1304 set thread context of 1720 1304 npgyood.exe npgyood.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

npgyood.exe

description pid process

Token: SeDebugPrivilege 1720 npgyood.exe

description	pid	process	target process
PID 1304 set thread context of 1720	1304	npgyood.exe	npgyood.exe

description	pid	process
Token: SeDebugPrivilege	1720	npgyood.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exenpgyood.exe

description	pid	process	target process
PID 844 wrote to memory of 1304	844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe	npgyood.exe
PID 844 wrote to memory of 1304	844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe	npgyood.exe
PID 844 wrote to memory of 1304	844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe	npgyood.exe
PID 844 wrote to memory of 1304	844	3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe
PID 1304 wrote to memory of 1720	1304	npgyood.exe	npgyood.exe

outlook_office_path 1 IoCs

Processes:

npgyood.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	npgyood.exe

outlook_win_path 1 IoCs

Processes:

npgyood.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	npgyood.exe

C:\Users\Admin\AppData\Local\Temp\3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe
"C:\Users\Admin\AppData\Local\Temp\3807df31a0db07c4ea7b4e06c0f8c2db76e3c84071319d1e1b356c62f3872512.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\npgyood.exe
C:\Users\Admin\AppData\Local\Temp\npgyood.exe C:\Users\Admin\AppData\Local\Temp\nyvtswlm
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\npgyood.exe
C:\Users\Admin\AppData\Local\Temp\npgyood.exe C:\Users\Admin\AppData\Local\Temp\nyvtswlm
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lhvuou84m711cc2w
Filesize
103KB

MD5
fd474cf94fdd4a8dbe493f359de6c462

SHA1
479f075924a33b24deae668687a4f796d0d1a717

SHA256
46668d893e4c69dc827d5a4bd3a90bf0f3495109ca801485a8aab1d8ec8e6fce

SHA512
97dfc107c6c20139c3a446a7333d09dac17543f93b9b63f80145a535b3699969671e9c348ce5d677cce84158f1c3ad174c39be66d5a1818325551e0c4b9f8b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nyvtswlm
Filesize
5KB

MD5
23cdded277028c18f674da015f72b9a9

SHA1
6494d95a79b3156fa77962a580389e7eef4bb281

SHA256
66ac4cf9d4a2fa25193eada60f9ee2550c981525156a5ef00e42127670b89466

SHA512
066dcabaf6563f58d764e5cb0917850e1a7813e8b21f49b653846292c4f3533f48b8d273704cb6201fe3e466a23a346e78d84979261d705ca11c1fc4110347c1

Download Submit
\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
\Users\Admin\AppData\Local\Temp\npgyood.exe
Filesize
74KB

MD5
0764c7cd2b5854386a5b6e52f9b73887

SHA1
570eb66a65dadccf4b776a5a90fafd1a459dad1e

SHA256
58505fe183014fa3ba0ce193c933e1f7b93f1cbbbdf06b67c14377bc71781ca4

SHA512
0a1a6098f079cd9692b6ba41b0dd3b69a0933e71eab6e29d599993598bd340b7b72c171f92dfd08fa6267abc90e9b70075424c194ec24a0fb04e54ae94b56afd

Download Submit
memory/844-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1304-57-0x0000000000000000-mapping.dmp

Download
memory/1720-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1720-65-0x00000000004139DE-mapping.dmp

Download
memory/1720-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1720-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads