lokibot | 89f7f601216e8c0364524db378f16a0298616bd614c17088e9cc4070357e6931

General

Target

46A05.CO.exe
Size

533KB
MD5

5f7378a03aa70ca7f2da90fa87fd85e9
SHA1

25eb0c72c4eaecc342317c35880adbbb3f5eba01
SHA256

89f7f601216e8c0364524db378f16a0298616bd614c17088e9cc4070357e6931
SHA512

7536eaeeb8b0a6aa0b0040d3e05d8c3be3fa6b779922e8f50994ea69c211563e923e108caf1cd305614d03b80bffbd41e0ebcc229c3caf35a8c23e777ce8dba2

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://198.187.30.47/p.php?id=614956569061910

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

46A05.CO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	46A05.CO.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	46A05.CO.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	46A05.CO.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

46A05.CO.exe

description pid process target process

PID 1756 set thread context of 1140 1756 46A05.CO.exe 46A05.CO.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1836 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1984 powershell.exe
2036 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

46A05.CO.exe

pid process

1140 46A05.CO.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exe46A05.CO.exe

description pid process

Token: SeDebugPrivilege 1984 powershell.exe
Token: SeDebugPrivilege 2036 powershell.exe
Token: SeDebugPrivilege 1140 46A05.CO.exe

description	pid	process	target process
PID 1756 set thread context of 1140	1756	46A05.CO.exe	46A05.CO.exe

pid	process
1836	schtasks.exe

pid	process
1984	powershell.exe
2036	powershell.exe

pid	process
1140	46A05.CO.exe

description	pid	process
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1140	46A05.CO.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

46A05.CO.exe

description	pid	process	target process
PID 1756 wrote to memory of 2036	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 2036	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 2036	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 2036	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 1984	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 1984	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 1984	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 1984	1756	46A05.CO.exe	powershell.exe
PID 1756 wrote to memory of 1836	1756	46A05.CO.exe	schtasks.exe
PID 1756 wrote to memory of 1836	1756	46A05.CO.exe	schtasks.exe
PID 1756 wrote to memory of 1836	1756	46A05.CO.exe	schtasks.exe
PID 1756 wrote to memory of 1836	1756	46A05.CO.exe	schtasks.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe
PID 1756 wrote to memory of 1140	1756	46A05.CO.exe	46A05.CO.exe

outlook_office_path 1 IoCs

Processes:

46A05.CO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	46A05.CO.exe

outlook_win_path 1 IoCs

Processes:

46A05.CO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	46A05.CO.exe

C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe
"C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ugJaDZJWfXk.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugJaDZJWfXk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0F8.tmp"
2⤵
- Creates scheduled task(s)
PID:1836

C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe
"C:\Users\Admin\AppData\Local\Temp\46A05.CO.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB0F8.tmp
Filesize
1KB

MD5
1c5161ef56984511b8c1e7edb2f7f1cf

SHA1
cf736efabaa27c3e1e245c44c251733f18b5ecc7

SHA256
75a8556175ed445fafc168b2f6b40eb5947c61a97f4e5027527c0353dcd608f1

SHA512
2ede861b708877227bf6c9abcb4bfef2ede80738817bfde1d96a4417fc84867b30f00d902dd9a5d8058e88a5cb5f68333b75a3e43d893eb80e621bf5865a893d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
ea6e6380d15a41c0698af3e60d9d87f3

SHA1
41b8642777a1318ecec89172abfdd675a03827e1

SHA256
b33d8c86f3a58e81cfacde14d6c8780a3e79a463c99f82b6ac27e6f5ba31f99c

SHA512
ada37025008ea88b577b1dc5d53ebdfe7aa3affd0248bf78108f074ba9d823dd68e89c759df703344e412e9cd2c92fdc512d06d7dd803370858768d33779cda0

Download Submit
memory/1140-78-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-85-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-70-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-84-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-76-0x00000000004139DE-mapping.dmp

Download
memory/1140-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1140-72-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1756-56-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download
memory/1756-58-0x0000000005000000-0x0000000005064000-memory.dmp

Filesize
400KB

Download
memory/1756-66-0x0000000005CC0000-0x0000000005CE0000-memory.dmp

Filesize
128KB

Download
memory/1756-55-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1756-57-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download
memory/1756-54-0x0000000001390000-0x000000000141A000-memory.dmp

Filesize
552KB

Download
memory/1836-62-0x0000000000000000-mapping.dmp

Download
memory/1984-81-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-82-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-61-0x0000000000000000-mapping.dmp

Download
memory/2036-80-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-83-0x000000006EE60000-0x000000006F40B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads