lokibot | f4a259bbe7e4f60710016ffc73a3cd1d272234e8b11447fed8261cb50cad4a16

General

Target

dacf588b59e2ea2c43f11b9beb1e08ff.exe
Size

533KB
MD5

dacf588b59e2ea2c43f11b9beb1e08ff
SHA1

a0305acdf7da67d1cc459353810e48ce1e234046
SHA256

f4a259bbe7e4f60710016ffc73a3cd1d272234e8b11447fed8261cb50cad4a16
SHA512

155a8e47f5a5a864e2b1baea30988e4edaa9516fc8117745f0f79b7adc315f0fc88971ff0768f5eaee771e0234238f06569c5413eaee978465a115dd9611795e

Score

10^/10

lokibot collection spyware stealer suricata trojan

Malware Config

Extracted

Family

lokibot

C2

http://37.0.11.227/rostov1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://��Ѝ��Й��Й��я��

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dacf588b59e2ea2c43f11b9beb1e08ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dacf588b59e2ea2c43f11b9beb1e08ff.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dacf588b59e2ea2c43f11b9beb1e08ff.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description pid process target process

PID 1224 set thread context of 1644 1224 dacf588b59e2ea2c43f11b9beb1e08ff.exe dacf588b59e2ea2c43f11b9beb1e08ff.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

pid process

1644 dacf588b59e2ea2c43f11b9beb1e08ff.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description pid process

Token: SeDebugPrivilege 1644 dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	pid	process	target process
PID 1224 set thread context of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe

pid	process
1644	dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	pid	process
Token: SeDebugPrivilege	1644	dacf588b59e2ea2c43f11b9beb1e08ff.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	pid	process	target process
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe
PID 1224 wrote to memory of 1644	1224	dacf588b59e2ea2c43f11b9beb1e08ff.exe	dacf588b59e2ea2c43f11b9beb1e08ff.exe

outlook_office_path 1 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dacf588b59e2ea2c43f11b9beb1e08ff.exe

outlook_win_path 1 IoCs

Processes:

dacf588b59e2ea2c43f11b9beb1e08ff.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dacf588b59e2ea2c43f11b9beb1e08ff.exe

C:\Users\Admin\AppData\Local\Temp\dacf588b59e2ea2c43f11b9beb1e08ff.exe
"C:\Users\Admin\AppData\Local\Temp\dacf588b59e2ea2c43f11b9beb1e08ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\dacf588b59e2ea2c43f11b9beb1e08ff.exe
"C:\Users\Admin\AppData\Local\Temp\dacf588b59e2ea2c43f11b9beb1e08ff.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-54-0x0000000001180000-0x000000000120A000-memory.dmp

Filesize
552KB

Download
memory/1224-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000000430000-0x0000000000450000-memory.dmp

Filesize
128KB

Download
memory/1224-57-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/1224-58-0x0000000005A60000-0x0000000005AC4000-memory.dmp

Filesize
400KB

Download
memory/1224-59-0x0000000001150000-0x0000000001170000-memory.dmp

Filesize
128KB

Download
memory/1644-60-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-61-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-69-0x00000000004139DE-mapping.dmp

Download
memory/1644-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-71-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-73-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1644-74-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads