lokibot_malware_detector_sysmon_behavior_july_2019

rule lokibot_malware_detector_sysmon_behavior_july_2019 {
 meta:
    author = "Lee Archinal"
    description = "This content detects characteristics of the Lokibot Malware that was found in July 2019  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/KxKQKAHdBNDw"
    version = "0.01"
    created = "2019/08/07"
    product = "windows"
    service = "sysmon"
    mitre = "defense_evasion, persistence, t1112, t1060"

  events:
((($selection1.metadata.product_event_type = "13" and (((($selection1.target.registry.registry_key = "HKCU\\Software\\VB and VBA Program Settings\\HcMI61124620925\\x60E5372900416" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\VB AND VBA PROGRAM SETTINGS\\HcMI61124620925" or $selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\VB and VBA Program Settings" or $selection1.target.registry.registry_key = "HKCU\\Software\\Microsoft\\Windows Script Host\\Settings" or $selection1.target.registry.registry_key = "HKLM\\Software\\Microsoft\\RADAR\\HeapLeakDetection\\Settings\\LeakDiagnosisAttempted" or $selection1.target.registry.registry_key = "HKLM\\http://chartinductries.com/nwata/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://lapphuongshoe.com/dino/five/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://suksez-ab.com/cola/five/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://tqe2009.com/bjoe/herold/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://www.runtaichem.info/rick/la/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://www.willhelmsen.com/orange/rok3/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://www.exwelloilfleld.com/fresh/julxxx/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://galeadz.info/jp/five/fre.php" or $selection1.target.registry.registry_key = "HKLM\\https://granjepages.com/wpincludes/star/png/jpeg/wpcontent/fre.php" or $selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\MICROSOFT\\RADAR\\HEAPLEAKDETECTION\\DIAGNOSEDAPPLICATIONS\\40413c204bb0867c9e93f83dc86d23cfcd420485519ffe9d27557585677d66d6.exe" or $selection1.target.registry.registry_key = "HKLM\\http://zooptiyoupoiunert.tk/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://hszna.com/class/five/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://lapphuongshoe.com/deal/five/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://www.ferosdwitama.pw/osi/la/fre.php" or $selection1.target.registry.registry_key = "HKLM\\http://versuvius.ru/java1/Panel/fre.php") or ($selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" and $selection1.metadata.description = "cghjjfygjhkjhgfghjt")) or ($selection1.target.registry.registry_key = "HKLM\\SOFTWARE\\MICROSOFT\\RADAR\\HEAPLEAKDETECTION\\DIAGNOSEDAPPLICATIONS\\40413C204BB0867C9E93F83DC86D23CFCD420485519FFE9D27557585677D66D6.EXE" and $selection1.metadata.description = "LastDetectionTime")) or ($selection1.target.registry.registry_key = "HKCU\\SOFTWARE\\VB AND VBA PROGRAM SETTINGS\\HCMI61124620925\\X60E5372900416" and $selection1.metadata.description = "bnVpl1584056334"))) or ($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*\\D282E1\\1E80C5\.lck`) or re.regex($selection1.target.file.full_path, `.*\\D282E1`) or re.regex($selection1.target.file.full_path, `.*\\subfolder\\filename\.vbs`) or re.regex($selection1.target.file.full_path, `.*\\subfolder`) or re.regex($selection1.target.file.full_path, `.*\\subfolder\\filename\.exe`) or re.regex($selection1.target.file.full_path, `.*\\cghjjfygjhkjhgfghjt`) or re.regex($selection1.target.file.full_path, `.*\\cghjjfygjhkjhgfghjt\\cghjjfygjhkjhgfghjt\.exe`) or re.regex($selection1.target.file.full_path, `.*\\cghjjfygjhkjhgfghjt\\cghjjfygjhkjhgfghjt\.vbs`)))) or ($selection1.metadata.product_event_type = "1" and (re.regex($selection1.target.process.file.full_path, `.*\\filename\.exe`) or re.regex($selection1.target.process.file.full_path, `.*\\cghjjfygjhkjhgfghjt\\cghjjfygjhkjhgfghjt\.exe`))))

  condition:
    $selection1
}