lokibot | 120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde

General

Target

120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe
Size

136KB
MD5

fefc83495ed902d83c464f33c73be672
SHA1

b510901c51a832807cebd3042e637b1b6cc073ef
SHA256

120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde
SHA512

5462ddbcc672f2e480296da6fcac86971e42ed89ea361e1f271d5f393d190674eba02def6e25f6c0277f2efc3285d4c123a9b273fa47fe32a897316d5de85200

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://hyatqfuh9olahvxf.gq/BN3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Executes dropped EXE 2 IoCs

Processes:

pgfvuocrty.exepgfvuocrty.exe

pid process

1336 pgfvuocrty.exe
620 pgfvuocrty.exe

pid	process
1336	pgfvuocrty.exe
620	pgfvuocrty.exe

Loads dropped DLL 3 IoCs

Processes:

120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exepgfvuocrty.exe

pid	process
2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe
2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe
1336	pgfvuocrty.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

pgfvuocrty.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pgfvuocrty.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	pgfvuocrty.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	pgfvuocrty.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pgfvuocrty.exe

description pid process target process

PID 1336 set thread context of 620 1336 pgfvuocrty.exe pgfvuocrty.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

pgfvuocrty.exe

description pid process

Token: SeDebugPrivilege 620 pgfvuocrty.exe

description	pid	process	target process
PID 1336 set thread context of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe

description	pid	process
Token: SeDebugPrivilege	620	pgfvuocrty.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exepgfvuocrty.exe

description	pid	process	target process
PID 2024 wrote to memory of 1336	2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe	pgfvuocrty.exe
PID 2024 wrote to memory of 1336	2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe	pgfvuocrty.exe
PID 2024 wrote to memory of 1336	2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe	pgfvuocrty.exe
PID 2024 wrote to memory of 1336	2024	120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe
PID 1336 wrote to memory of 620	1336	pgfvuocrty.exe	pgfvuocrty.exe

outlook_office_path 1 IoCs

Processes:

pgfvuocrty.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	pgfvuocrty.exe

outlook_win_path 1 IoCs

Processes:

pgfvuocrty.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	pgfvuocrty.exe

C:\Users\Admin\AppData\Local\Temp\120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe
"C:\Users\Admin\AppData\Local\Temp\120d7ef376454fef4b398d84c8798924b8052e9045a8fc6a6ded73070774afde.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe C:\Users\Admin\AppData\Local\Temp\txwyrw
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe C:\Users\Admin\AppData\Local\Temp\txwyrw
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b1dgizdden4lgh
Filesize
103KB

MD5
b613555bd6a00d77f0faf33e8a8072c1

SHA1
510f953de1b6c4d5f1d709ee7e08af323c3da82a

SHA256
dade3d22c64a8de3d4159bf875ec12dc8f91d61d587d8aa1f59f1aa43c87f9b7

SHA512
d377f505f467337d9c222121c9cf04283304282831d28790c15914398f735232c88f5b23c24d253ea579c9ed6a1ca8520d773ada9f3707bd247c64713d518846

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
C:\Users\Admin\AppData\Local\Temp\txwyrw
Filesize
5KB

MD5
5050405b04e5dcca06590e84fabdc407

SHA1
5f00730506283326aac711e192d61e316f3a2728

SHA256
9552c2fe44b64ce36432a8e5d1ecc48dd204c97751d4e8f395d1cc987ced2385

SHA512
5b82c24ebcbf1c1b670c1b12164089707c33004a9813105003897c8f58a91105bf9cc1a52d97f87c4b43f9c33c4a0274ad7500e7edd0b6fa3b8f33191298701f

Download Submit
\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
\Users\Admin\AppData\Local\Temp\pgfvuocrty.exe
Filesize
5KB

MD5
621d8e2c6cde20fcf87ba0fc16e9c22c

SHA1
d968bbb69b7de421ef996a9b3ea3dc8116b59ac5

SHA256
933e90f390eb8083ed553a0a0334a13663bf7226e137d118de52d2fd03f2f1d1

SHA512
ad45da5902a31bf90d8bbe5e5597ec063ab52dfb6204fd79d59abb805a52016a4362c605f387080796b4ee9db9c9c9b01cb8fcc9af88bc95047a5544afe83000

Download Submit
memory/620-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/620-65-0x00000000004139DE-mapping.dmp

Download
memory/620-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/620-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1336-57-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads