lokibot | 6091c72afc1b64e11cca31aa5375871a3e3b99e769e20bc95abe7fc4a6626f7e

Analysis

Target
Shipping docs024916_pdf.exe
Size 1.2MB
Sample201109-ff513rcahj
SHA256 6091c72afc1b64e11cca31aa5375871a3e3b99e769e20bc95abe7fc4a6626f7e
MD5 160b4cfb7bbb67120ca922f92ba258f3
SHA1 10b6514048d190963f8797421574ab93beb9f71c
SHA512 daea1d67dce6dcd2efb21f2bda1236aa710662fbaa0509d5aa5f34b1b78650204197b28dda8ddefba5f807ffb1d4578e12fdc3f6796ac63016c8c09d459619e9
MD5 SHA1 SHA512

Score

10^/10

Family

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 1632	1036	Shipping docs024916_pdf.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1632	1036	Shipping docs024916_pdf.exe	75
PID 1036 wrote to memory of 1632	1036	Shipping docs024916_pdf.exe	75
PID 1036 wrote to memory of 1632	1036	Shipping docs024916_pdf.exe	75
PID 1036 wrote to memory of 1632	1036	Shipping docs024916_pdf.exe	75
PID 1036 wrote to memory of 1632	1036	Shipping docs024916_pdf.exe	75

C:\Users\Admin\AppData\Local\Temp\Shipping docs024916_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping docs024916_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1632

memory/1632-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download