lokibot | 24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139

General

Target

24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe
Size

136KB
MD5

4e59abfcc6537ad26941fa659093991f
SHA1

e81af7081b079a2cbaee809a6f46610f296d4bc3
SHA256

24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139
SHA512

682ae2acf7a85f9b4886c799123a5c65d4c761d28a821102cae541508189653e63888014d070390ae413f2bde60ff37e55c168a17debb1c3a0ef5f15078f103d

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

fseepzfx.exefseepzfx.exe

pid process

2548 fseepzfx.exe
4772 fseepzfx.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2548	fseepzfx.exe
4772	fseepzfx.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

fseepzfx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fseepzfx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	fseepzfx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fseepzfx.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fseepzfx.exe

description pid process target process

PID 2548 set thread context of 4772 2548 fseepzfx.exe fseepzfx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fseepzfx.exe

description pid process

Token: SeDebugPrivilege 4772 fseepzfx.exe

description	pid	process	target process
PID 2548 set thread context of 4772	2548	fseepzfx.exe	fseepzfx.exe

description	pid	process
Token: SeDebugPrivilege	4772	fseepzfx.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exefseepzfx.exe

description	pid	process	target process
PID 2700 wrote to memory of 2548	2700	24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe	fseepzfx.exe
PID 2700 wrote to memory of 2548	2700	24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe	fseepzfx.exe
PID 2700 wrote to memory of 2548	2700	24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe
PID 2548 wrote to memory of 4772	2548	fseepzfx.exe	fseepzfx.exe

outlook_office_path 1 IoCs

Processes:

fseepzfx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	fseepzfx.exe

outlook_win_path 1 IoCs

Processes:

fseepzfx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	fseepzfx.exe

C:\Users\Admin\AppData\Local\Temp\24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe
"C:\Users\Admin\AppData\Local\Temp\24225cdf9146985a318fa78678b2d0544a460fc02d7794ff3efed65c4217f139.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe
C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe C:\Users\Admin\AppData\Local\Temp\btxilujbaa
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe
C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe C:\Users\Admin\AppData\Local\Temp\btxilujbaa
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\btxilujbaa
Filesize
4KB

MD5
f13508c686611010922c508749be5d2a

SHA1
4a7bebc4af552e3e1a08b734558ce81d4a213f1f

SHA256
23053864568ddab3885e6769e07ffa6cdb0ea8001cb0c64b569696546328540c

SHA512
52974169e0b42eb9ce918692ac8fc470eecdb164b123f0b031994373a462d5b580f90dc0711de660a9100033fd3c8b6e1eb80722fd1b7364817f099316704da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe
Filesize
5KB

MD5
1bd3ffe4e399ac9d1158376ec1c98b39

SHA1
8c63c5bc940e89bf5d128610a31967eb09d4c9a7

SHA256
981ae7e219cb1c242e17ffb671fd3aec0e5c9b670ab9b26f7c457bab6f8de742

SHA512
b7aa0f442e2208b2bb6760699c18f4e96ea445f542e37080e19da1496843404c4ba8183845254bfc31e9391e8f700ddd82550bcacdfd673ea22636733da884fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe
Filesize
5KB

MD5
1bd3ffe4e399ac9d1158376ec1c98b39

SHA1
8c63c5bc940e89bf5d128610a31967eb09d4c9a7

SHA256
981ae7e219cb1c242e17ffb671fd3aec0e5c9b670ab9b26f7c457bab6f8de742

SHA512
b7aa0f442e2208b2bb6760699c18f4e96ea445f542e37080e19da1496843404c4ba8183845254bfc31e9391e8f700ddd82550bcacdfd673ea22636733da884fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fseepzfx.exe
Filesize
5KB

MD5
1bd3ffe4e399ac9d1158376ec1c98b39

SHA1
8c63c5bc940e89bf5d128610a31967eb09d4c9a7

SHA256
981ae7e219cb1c242e17ffb671fd3aec0e5c9b670ab9b26f7c457bab6f8de742

SHA512
b7aa0f442e2208b2bb6760699c18f4e96ea445f542e37080e19da1496843404c4ba8183845254bfc31e9391e8f700ddd82550bcacdfd673ea22636733da884fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\spyba1m4fz68fbp
Filesize
103KB

MD5
eaa5df38f0da000dc13e4d4660d7ae49

SHA1
397bce4964d88690344bfc1b42dcbb86a9a229b8

SHA256
0798d2fd9007807319d14ae4754305816bc9da8bbf7862cab212a3d1049cf58e

SHA512
f44ac032c9bd3c17c8845057f2cdae12049f4ff5fc57ca63d2d67d68e8dc316c0d1ef31dae2daf1de236f21c26f1f226c9be156166574d451ce71fa7d51c4c1d

Download Submit
memory/2548-130-0x0000000000000000-mapping.dmp

Download
memory/4772-135-0x0000000000000000-mapping.dmp

Download
memory/4772-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4772-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4772-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads