lokibot | 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48

Analysis

Target
LV_BALTTRA_202012LTD.exe
Size 1.1MB
Sample201109-6ll1bpmdyn
SHA256 25aaaf18e2bd8f09ed33157220bfbfbf02ba8387a0439eee6c908439a663ec48
MD5 ea519dcf0455ac35ce7acef948a31c64
SHA1 539fddc8f6ed5e6ad1bda6966171c6d05cf4e3fc
SHA512 f4303b81a93a083afe25245c2cbf6104834b5a11180835353b16c754ac933ef4782f7efa39ca628e8534574a04562da1986d834f746ba058734cc20769ffe0f7
MD5 SHA1 SHA512

Score

10^/10

Family

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 3920	1036	LV_BALTTRA_202012LTD.exe	76

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3920	1036	LV_BALTTRA_202012LTD.exe	76
PID 1036 wrote to memory of 3920	1036	LV_BALTTRA_202012LTD.exe	76
PID 1036 wrote to memory of 3920	1036	LV_BALTTRA_202012LTD.exe	76
PID 1036 wrote to memory of 3920	1036	LV_BALTTRA_202012LTD.exe	76
PID 1036 wrote to memory of 3920	1036	LV_BALTTRA_202012LTD.exe	76

C:\Users\Admin\AppData\Local\Temp\LV_BALTTRA_202012LTD.exe
"C:\Users\Admin\AppData\Local\Temp\LV_BALTTRA_202012LTD.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

memory/3920-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download