lokibot | 11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e

General

Target

11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe
Size

123KB
MD5

ecd214e92cab6fb7e793a9068303bc7b
SHA1

93e56deee788685d9166810b0147b841516216f0
SHA256

11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e
SHA512

7bfc1a75cc8acc43a4047957405300dd868507a04c8da7f0c4d3e56ea34a773b9768930212bf93880a1bdb95feaf9d8e1d3d87962c66f879615b77f8e78922aa

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://85.202.169.172/goodlife/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

wvliufrms.exewvliufrms.exe

pid process

1464 wvliufrms.exe
776 wvliufrms.exe

pid	process
1464	wvliufrms.exe
776	wvliufrms.exe

Loads dropped DLL 3 IoCs

Processes:

11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exewvliufrms.exe

pid	process
1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe
1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe
1464	wvliufrms.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

wvliufrms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wvliufrms.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wvliufrms.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wvliufrms.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wvliufrms.exe

description pid process target process

PID 1464 set thread context of 776 1464 wvliufrms.exe wvliufrms.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wvliufrms.exe

description pid process

Token: SeDebugPrivilege 776 wvliufrms.exe

description	pid	process	target process
PID 1464 set thread context of 776	1464	wvliufrms.exe	wvliufrms.exe

description	pid	process
Token: SeDebugPrivilege	776	wvliufrms.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exewvliufrms.exe

description	pid	process	target process
PID 1968 wrote to memory of 1464	1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe	wvliufrms.exe
PID 1968 wrote to memory of 1464	1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe	wvliufrms.exe
PID 1968 wrote to memory of 1464	1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe	wvliufrms.exe
PID 1968 wrote to memory of 1464	1968	11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe
PID 1464 wrote to memory of 776	1464	wvliufrms.exe	wvliufrms.exe

outlook_office_path 1 IoCs

Processes:

wvliufrms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wvliufrms.exe

outlook_win_path 1 IoCs

Processes:

wvliufrms.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wvliufrms.exe

C:\Users\Admin\AppData\Local\Temp\11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe
"C:\Users\Admin\AppData\Local\Temp\11093db310a4d793244ae42534acd614d8e4b27f635b7377954f7fd2f515d66e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe
C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe C:\Users\Admin\AppData\Local\Temp\kqxveyi
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe
C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe C:\Users\Admin\AppData\Local\Temp\kqxveyi
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kqxveyi
Filesize
4KB

MD5
239af6ffd228c13c7b7f2a939f15987e

SHA1
e25481217bfa6e8ee647ae2d36f04c794d6af00a

SHA256
f4097199f18b1227c286d169f0dfe388eb2f9484f4fb60a0b232d3f1381a7ee2

SHA512
8c7565498c857384d4550c421d03a5a7e5dab898fc0a4749e790977f1f9141209cd9a9908ad7045c3f5d313ca501eb94ee0b49282ffee54a7fc5839080684ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\zy1z0frvhwqp9mh9a
Filesize
103KB

MD5
65c748b433930a336f763c92098e4409

SHA1
c60e6703a59701d90082fd04236d4b94ffcf8f41

SHA256
8f65db099c339727170bb107afcb60bfc403c1e4aed594bc0327218f75317345

SHA512
b71efaeddf18083d84b08220f2459bc664ccae904902642ab9adba4e7032d8eeaa002f394e992f1ba090016106b56a491a06869ddbe448abb32ebec9626af428

Download Submit
\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
\Users\Admin\AppData\Local\Temp\wvliufrms.exe
Filesize
3KB

MD5
2939f35d1610d19f9114d7a064aa7f52

SHA1
a4b297a46e1414a203943f615ddea9e9dbdd005e

SHA256
62080367ac252324a98920f8a9b0fe39e0d391a72067fbdab2b85ac2e0338faa

SHA512
ff73a4b3394e5ccd09b8676be44de25c77968b1245d1af52fb849208efd5a4b4c6e00d03e75b9882f39a1f98161f9a07ff5e54c11c45186a55d53225a9db0e64

Download Submit
memory/776-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/776-65-0x00000000004139DE-mapping.dmp

Download
memory/776-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/776-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1464-57-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads