lokibot | c015de0626ba91b194a47d0c8d76594e1bddadae9d9a6891b26ff7c2bc0fade3

Analysis

Target
YHFN.exe
Size 232KB
Sample201109-ecfv4fhy82
SHA256 c015de0626ba91b194a47d0c8d76594e1bddadae9d9a6891b26ff7c2bc0fade3
MD5 d10a17ae51752b8882807dd6c7c64ecc
SHA1 b13888dd1c84851aa782f7bdb771d32d83332a49
SHA512 ba9ff28868babf9cacd424e821866784c9a83f4e28db6b50370761714ddd89501de9ecc0979ec8d44a3c710794a2b28ffa84aefed52f796bd67bf2de3491fe57
MD5 SHA1 SHA512

Score

10^/10

Family

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Executes dropped EXE 2 IoCs

pid	Process
724	LOPRi.sfx.exe
3292	LOPRi.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3292 set thread context of 4228	3292	LOPRi.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3292	LOPRi.exe
3292	LOPRi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	LOPRi.exe
Token: SeDebugPrivilege	4228	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3076	4708	YHFN.exe	74
PID 4708 wrote to memory of 3076	4708	YHFN.exe	74
PID 4708 wrote to memory of 3076	4708	YHFN.exe	74
PID 3076 wrote to memory of 724	3076	cmd.exe	78
PID 3076 wrote to memory of 724	3076	cmd.exe	78
PID 3076 wrote to memory of 724	3076	cmd.exe	78
PID 724 wrote to memory of 3292	724	LOPRi.sfx.exe	79
PID 724 wrote to memory of 3292	724	LOPRi.sfx.exe	79
PID 724 wrote to memory of 3292	724	LOPRi.sfx.exe	79
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80
PID 3292 wrote to memory of 4228	3292	LOPRi.exe	80

C:\Users\Admin\AppData\Local\Temp\YHFN.exe
"C:\Users\Admin\AppData\Local\Temp\YHFN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\UJHOPRi.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Roaming\LOPRi.sfx.exe
    LOPRi.sfx.exe -pKmjMnHGFGtiKjPljMnbgtrfv768Cxdse989FnHTHYjMJhjnKL -dC:\Users\Admin\AppData\Roaming
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Users\Admin\AppData\Roaming\LOPRi.exe
      "C:\Users\Admin\AppData\Roaming\LOPRi.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\System32\svchost.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228

memory/4228-10-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4228-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Download