lokibot | 898e7a974fb01f10d52cdec65c153e570e827b16c7e026eb78fc2d439bb3fb16

General

Target
Scan098767989pdf.exe
Size 200KB
Sample220525-nfenvadhgr
SHA256 898e7a974fb01f10d52cdec65c153e570e827b16c7e026eb78fc2d439bb3fb16
MD5 61fb46422e318b2d052c76f75d5d20e4
SHA1 55c604e6e20a0371bdc034515f3e3198d1eb5f6d
SHA512 9c3a7843539e2996741033c974160af3210489253a55bc554d19f73b5fcbd40b83165be20a22dbbf46be3fe9c5bc9d5860a6f00b586ae000194276c583e1b29f
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://lokaxz.xyz/fc/bk/ss.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Executes dropped EXE 2 IoCs

pid	Process
1336	wdmkwey.exe
2564	wdmkwey.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wdmkwey.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wdmkwey.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wdmkwey.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 2564	1336	wdmkwey.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	wdmkwey.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1336	2672	Scan098767989pdf.exe	80
PID 2672 wrote to memory of 1336	2672	Scan098767989pdf.exe	80
PID 2672 wrote to memory of 1336	2672	Scan098767989pdf.exe	80
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81
PID 1336 wrote to memory of 2564	1336	wdmkwey.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wdmkwey.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wdmkwey.exe

C:\Users\Admin\AppData\Local\Temp\Scan098767989pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Scan098767989pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe
  C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe C:\Users\Admin\AppData\Local\Temp\rdpigzxi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe
    C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe C:\Users\Admin\AppData\Local\Temp\rdpigzxi
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aqvaa81n6cenbcg9

Path C:\Users\Admin\AppData\Local\Temp\aqvaa81n6cenbcg9
Size 103KB
SHA256 485b59dcb0a5221c913b60adb2090775fb86c98e00c14d6b2af9fdbf921cfb05
MD5 c472c9111f156546672e46fb3ef5103c
SHA1 8cdf1398898505cee4a5d8889b32edd1939fdf14
SHA512 fc452f2308556a9cd47ff233c9b2764468aa8e6637ddbfe458ddc5c4c7ad39e64f42e2f070631b438c7bcd18d5dcf71ff3e214b24a8387f7778349acd3f13b16
SSDEEP 3072:03sDRCwnXSo7Yq11DKfzr/XEtmJo1EJmy:08DFXSoLD2rstmJo1Ecy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdpigzxi

Path C:\Users\Admin\AppData\Local\Temp\rdpigzxi
Size 4KB
SHA256 da69da5060297ae9596025ec006662bbaa7944c7dd8565c96d2592cf53d4cd32
MD5 a1dadca63f00808087b3354b3d89d98c
SHA1 e403282af8bfdca08be835ad471303a0bb6e20e1
SHA512 dcdfe39e6e41cdf526568b08003036daa24c80ba2fc0a459bfa598c151f5d3d8bd9bf2c577ace639a816235dbdc2ebc6e2bf60e89fc085fb46b000b01f18b27f
SSDEEP 96:0HO8iV8XTPt6taK3yl1GdigQgfidMrYKX6jdvc2:0HO8iWTPtQERvgKdu6jdb
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdmkwey.exe

Path C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe
Size 184KB
SHA256 fb209cf3960731e71b776a23f6044d28f00c3a7297f213e56e315d01f28c098a
MD5 f79df2c9d1bd5eccead727ebe785ebce
SHA1 c29019256017bc20ce9896e2894745faff70ba39
SHA512 fef84304756e49822ec3b300a3db5839e6dd7986fce05624e34eba7a930adad4b3092ed7340181e724625d5c6704280a73b487f9c288da6ed30b680a9c60ce5e
SSDEEP 3072:4wAlaoUr0/UcJV2Gj+UtG3cF9B4vVMPVwabo+wWl14:rAJUKxJVxUqB4vq2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdmkwey.exe

Path C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe
Size 184KB
SHA256 fb209cf3960731e71b776a23f6044d28f00c3a7297f213e56e315d01f28c098a
MD5 f79df2c9d1bd5eccead727ebe785ebce
SHA1 c29019256017bc20ce9896e2894745faff70ba39
SHA512 fef84304756e49822ec3b300a3db5839e6dd7986fce05624e34eba7a930adad4b3092ed7340181e724625d5c6704280a73b487f9c288da6ed30b680a9c60ce5e
SSDEEP 3072:4wAlaoUr0/UcJV2Gj+UtG3cF9B4vVMPVwabo+wWl14:rAJUKxJVxUqB4vq2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdmkwey.exe

Path C:\Users\Admin\AppData\Local\Temp\wdmkwey.exe
Size 184KB
SHA256 fb209cf3960731e71b776a23f6044d28f00c3a7297f213e56e315d01f28c098a
MD5 f79df2c9d1bd5eccead727ebe785ebce
SHA1 c29019256017bc20ce9896e2894745faff70ba39
SHA512 fef84304756e49822ec3b300a3db5839e6dd7986fce05624e34eba7a930adad4b3092ed7340181e724625d5c6704280a73b487f9c288da6ed30b680a9c60ce5e
SSDEEP 3072:4wAlaoUr0/UcJV2Gj+UtG3cF9B4vVMPVwabo+wWl14:rAJUKxJVxUqB4vq2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2564-136-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2564-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2564-140-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads