lokibot | ec70df5d6e789759aba200e31c25b8bc9657f973d0fad4c79ef5efb880efa5b0

General

Target
Purchase Order.exe
Size 1.4MB
Sample220606-x272ysfdaq
SHA256 ec70df5d6e789759aba200e31c25b8bc9657f973d0fad4c79ef5efb880efa5b0
MD5 f750a6df1e0df375f06fb52c7baebf79
SHA1 ff1453fe92df05336803140e940d6198b837b8e9
SHA512 eddccdc5fcd0b6497d307a14047e99361cd9a6f8eb161b366c6ce2bc3a0058c25535fb589b0f6ccb650029f1dc43fbd0ede7d082891b31fc7669d0635693ec00
MD5 SHA1 SHA512

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

https://logs1.co.vu/netifier/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SettingSyncHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	SettingSyncHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	SettingSyncHost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 1920	1108	Purchase Order.exe	86

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe
1108	Purchase Order.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	Purchase Order.exe
Token: SeDebugPrivilege	1920	SettingSyncHost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 896	1108	Purchase Order.exe	85
PID 1108 wrote to memory of 896	1108	Purchase Order.exe	85
PID 1108 wrote to memory of 896	1108	Purchase Order.exe	85
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86
PID 1108 wrote to memory of 1920	1108	Purchase Order.exe	86

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	SettingSyncHost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SettingSyncHost.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe
  "C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe"
  2⤵
  PID:896
- C:\Windows\SysWOW64\SettingSyncHost.exe
  "C:\Windows\SysWOW64\SettingSyncHost.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-130-0x0000000000450000-0x00000000005BA000-memory.dmp

Download

memory/1108-131-0x0000000005780000-0x000000000581C000-memory.dmp

Download

memory/1920-134-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1920-136-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1920-137-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1920-138-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads