lokibot | 39cefe8dd528b6b8efc18753c0ee70e4c712f1cc5137e25564e2bb5cd3ff64d8

General

Target
0b9ad26b6565bdcdcffa310df4944096.exe
Size 156KB
Sample220516-qdr79scfd2
SHA256 39cefe8dd528b6b8efc18753c0ee70e4c712f1cc5137e25564e2bb5cd3ff64d8
MD5 0b9ad26b6565bdcdcffa310df4944096
SHA1 28909e382df3f0853737d5961e9d7d8341bb1a84
SHA512 e68c2c9d6ce5c0ab2c1dc5201d732dbf6a8fdaf57271a415ba7573e98461da0a33bd1d544c2e3aca9b42dbdd19948c6ca584140e7394d05b3d371ae98fbfc1e0
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1308	oomepxflrd.exe
1500	oomepxflrd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	oomepxflrd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	oomepxflrd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	oomepxflrd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1308 set thread context of 1500	1308	oomepxflrd.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	oomepxflrd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1308	1996	0b9ad26b6565bdcdcffa310df4944096.exe	81
PID 1996 wrote to memory of 1308	1996	0b9ad26b6565bdcdcffa310df4944096.exe	81
PID 1996 wrote to memory of 1308	1996	0b9ad26b6565bdcdcffa310df4944096.exe	81
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83
PID 1308 wrote to memory of 1500	1308	oomepxflrd.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	oomepxflrd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	oomepxflrd.exe

C:\Users\Admin\AppData\Local\Temp\0b9ad26b6565bdcdcffa310df4944096.exe
"C:\Users\Admin\AppData\Local\Temp\0b9ad26b6565bdcdcffa310df4944096.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe
  C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe C:\Users\Admin\AppData\Local\Temp\ztaprtwjc
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe
    C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe C:\Users\Admin\AppData\Local\Temp\ztaprtwjc
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17cx0e27ef9c98y1yc

Path C:\Users\Admin\AppData\Local\Temp\17cx0e27ef9c98y1yc
Size 103KB
SHA256 ab03d68f47cef9947d45585282527745636ba5065512bd42e72e3f27e793b107
MD5 74005b98929f24a5673cc5e7372e8d19
SHA1 7854d68210cb9b25dc4c1c514b92e0762e548f4c
SHA512 f5d6241f4d5d48896f498ea8ea8c3819b0464e5008f49b2abd3d6f6f9ff7f70739913f1ba1016040ebc37292b376b4da4261417083c28d15231393684463b929
SSDEEP 1536:9+kaXASDSILsRJKT7hRnyYz1HC5H+qUkhzJud0EK7XJ+u9XZfBgSTkuJL1E:9+kMRpoYhym1ikqjhzc21XJjdB7JK
MD5 SHA1 SHA512 SSDEEP

Submit Download

oomepxflrd.exe

Path C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe
Size 74KB
SHA256 2e2b72c54bb0406ecb6c0be703b80b53ad2c224f3bef5ebf3f9b732c09fd46fe
MD5 b92571a22b346835f4edef5a6914a445
SHA1 3b0c257ea86561669570751285d841142e10ec98
SHA512 52ddc99f864b35c4c835ba50c473375f52db6ee8bf4e920428a528b53fa8c4b11c10b4128a5d8541c1c1a38fbbae64b504f281c0299dae3a6e8366bdf7e4d8bc
SSDEEP 1536:nkGCLhhRfYI46RqkTuxUkHQldYg4kvcczegsWjcdnF:nqhbfskTGcld7zMnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

oomepxflrd.exe

Path C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe
Size 74KB
SHA256 2e2b72c54bb0406ecb6c0be703b80b53ad2c224f3bef5ebf3f9b732c09fd46fe
MD5 b92571a22b346835f4edef5a6914a445
SHA1 3b0c257ea86561669570751285d841142e10ec98
SHA512 52ddc99f864b35c4c835ba50c473375f52db6ee8bf4e920428a528b53fa8c4b11c10b4128a5d8541c1c1a38fbbae64b504f281c0299dae3a6e8366bdf7e4d8bc
SSDEEP 1536:nkGCLhhRfYI46RqkTuxUkHQldYg4kvcczegsWjcdnF:nqhbfskTGcld7zMnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

oomepxflrd.exe

Path C:\Users\Admin\AppData\Local\Temp\oomepxflrd.exe
Size 74KB
SHA256 2e2b72c54bb0406ecb6c0be703b80b53ad2c224f3bef5ebf3f9b732c09fd46fe
MD5 b92571a22b346835f4edef5a6914a445
SHA1 3b0c257ea86561669570751285d841142e10ec98
SHA512 52ddc99f864b35c4c835ba50c473375f52db6ee8bf4e920428a528b53fa8c4b11c10b4128a5d8541c1c1a38fbbae64b504f281c0299dae3a6e8366bdf7e4d8bc
SSDEEP 1536:nkGCLhhRfYI46RqkTuxUkHQldYg4kvcczegsWjcdnF:nqhbfskTGcld7zMnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ztaprtwjc

Path C:\Users\Admin\AppData\Local\Temp\ztaprtwjc
Size 5KB
SHA256 3912a4ae6bf8fb30394dbfe312688867e76d6985a73e29609baaf75595ebe6ab
MD5 3acbf4938d4d29015c3e16ef0b4d4fb5
SHA1 28414b4e51407d461bcaaf8932f2f8428dce8bba
SHA512 509311f952c62ae62b736e728555195f613102038e17f6508156be50638817a91af91198338be43a8b9bd28bcb8e82961eb36e1c27a032be1da1469d05edecfd
SSDEEP 96:VrsxuuLYh0rQtBCSajVjjKjyXQ0GiWGKoKacgR4EEIxJ:Vr7HrB3ajVjjKjX0GXaZ2E5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1500-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1500-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1500-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads