lokibot | d1741f7d3bcad64ecf32ff7826e107b80f79fe04e8b9d8c7bba6f6ddf8bf4407

General

Target
e95ec4d6653fd04defa43e0503d4314a.exe
Size 182KB
Sample220516-qdr79sfbek
SHA256 d1741f7d3bcad64ecf32ff7826e107b80f79fe04e8b9d8c7bba6f6ddf8bf4407
MD5 e95ec4d6653fd04defa43e0503d4314a
SHA1 cbaf75ea7736a5ef1f08ac5952e2a627920c4b54
SHA512 f2863534ae012c4cd3eb63ff0807e5c65ab0d2793b70fd3b08547eb75710df7201381f03bdc70d61da692d2b1358d9b4b1cd0e4f6c2f8123971927ac6ca63b32
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1620	coqeed.exe
3648	coqeed.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	coqeed.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	coqeed.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	coqeed.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 3648	1620	coqeed.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	coqeed.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1620	4260	e95ec4d6653fd04defa43e0503d4314a.exe	85
PID 4260 wrote to memory of 1620	4260	e95ec4d6653fd04defa43e0503d4314a.exe	85
PID 4260 wrote to memory of 1620	4260	e95ec4d6653fd04defa43e0503d4314a.exe	85
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86
PID 1620 wrote to memory of 3648	1620	coqeed.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	coqeed.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	coqeed.exe

C:\Users\Admin\AppData\Local\Temp\e95ec4d6653fd04defa43e0503d4314a.exe
"C:\Users\Admin\AppData\Local\Temp\e95ec4d6653fd04defa43e0503d4314a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\coqeed.exe
  C:\Users\Admin\AppData\Local\Temp\coqeed.exe C:\Users\Admin\AppData\Local\Temp\deferxibr
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\coqeed.exe
    C:\Users\Admin\AppData\Local\Temp\coqeed.exe C:\Users\Admin\AppData\Local\Temp\deferxibr
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

coqeed.exe

Path C:\Users\Admin\AppData\Local\Temp\coqeed.exe
Size 78KB
SHA256 229a0b13c1fd5335a228147a123b8a2c7e2ac31b47aa84cd5bf785687c0226bf
MD5 0dd1975bb99cdd4046a4269f7e4e43f8
SHA1 9dab7e1446910f208efb93a16a088657907da98d
SHA512 5f7f8b066c0ca30cfef8e8582c64e4855788253d2dc76a15614f8405e2b9428ca401c9407763d4da8e98010f4b29a2624646add49bd9037afdeea5f57773994b
SSDEEP 1536:G+XiCaQLE7nrdoxA4InDcXqPvx2rsWjcdC5:jiqg7rkatC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

coqeed.exe

Path C:\Users\Admin\AppData\Local\Temp\coqeed.exe
Size 78KB
SHA256 229a0b13c1fd5335a228147a123b8a2c7e2ac31b47aa84cd5bf785687c0226bf
MD5 0dd1975bb99cdd4046a4269f7e4e43f8
SHA1 9dab7e1446910f208efb93a16a088657907da98d
SHA512 5f7f8b066c0ca30cfef8e8582c64e4855788253d2dc76a15614f8405e2b9428ca401c9407763d4da8e98010f4b29a2624646add49bd9037afdeea5f57773994b
SSDEEP 1536:G+XiCaQLE7nrdoxA4InDcXqPvx2rsWjcdC5:jiqg7rkatC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

coqeed.exe

Path C:\Users\Admin\AppData\Local\Temp\coqeed.exe
Size 78KB
SHA256 229a0b13c1fd5335a228147a123b8a2c7e2ac31b47aa84cd5bf785687c0226bf
MD5 0dd1975bb99cdd4046a4269f7e4e43f8
SHA1 9dab7e1446910f208efb93a16a088657907da98d
SHA512 5f7f8b066c0ca30cfef8e8582c64e4855788253d2dc76a15614f8405e2b9428ca401c9407763d4da8e98010f4b29a2624646add49bd9037afdeea5f57773994b
SSDEEP 1536:G+XiCaQLE7nrdoxA4InDcXqPvx2rsWjcdC5:jiqg7rkatC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

deferxibr

Path C:\Users\Admin\AppData\Local\Temp\deferxibr
Size 5KB
SHA256 9c7280898dc728554b4fa259f14e5ad125d015d09bae4604b22ebf813a346d2b
MD5 c4a1f9583d6b7513aca4db1e20c0e0c1
SHA1 9e38b1b7c88e507c00665798b2b2d9e7103cd813
SHA512 a7a775f7e8cf65804241ff1bbe901510cb63bff4dda9585880e3345a8b80d33c9cd6379206973bed6f5fc034f5f99adf547dc3db0fd1f8b44e79bf30ac9e5672
SSDEEP 96:bzTuxjcZ5B24G0bKDkDUSbfk2lu3C4R6Kx/+UMURh2xqT3kkACajuACGSN:3Cxje250WgDPb7lu5cKHAcDwCwJSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xv9na738tkzdglcx

Path C:\Users\Admin\AppData\Local\Temp\xv9na738tkzdglcx
Size 103KB
SHA256 e80d8ec648e63be73347aa63646808935b95296f2ae63e41f280f373f38286ed
MD5 b98220c6e2e2fada70accebea7d2b863
SHA1 dd8590ed4d8ea246c36e9085c04cd9609e11f7ec
SHA512 c81a9eca7067157a8f125836ef1f1d77059b39323cbb80dbec22ca7ec4341ae1532fa3dc2b5bf4e842b9a508fec1e8a3aa54c6fc636b25e894ba9c0be3e79059
SSDEEP 1536:GRvKAVK8gAujwjy3irXfced0QLeAhfnLFWgaf6FQzEbfmLArANoZxOgekTkZCi9Q:gcji+ir30OFfaY/bmLAAoZx9Tc9bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3648-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3648-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3648-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads