lokibot | e34ea10e33cac3cd7e82feb163446f1fbbff7c024eafcfd330e62e66f285062d

Analysis

Target
9364b232d5ef553f6df20e977e1a9ca2.exe
Size 1.2MB
Sample201109-wcwpde34jn
SHA256 e34ea10e33cac3cd7e82feb163446f1fbbff7c024eafcfd330e62e66f285062d
MD5 9364b232d5ef553f6df20e977e1a9ca2
SHA1 dc4ca2f316580b02e9a027606dc2087475aa3724
SHA512 58e579f506619034092e3ebf6057e2ca328b79c61d9d39983a135e17c615de2dcc5d0e3c34a1adaa3626034eb2d64597b6bda032549dc139fd17bd5a6984cce5
MD5 SHA1 SHA512

Score

10^/10

Family

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	dllhost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76
PID 1036 wrote to memory of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76
PID 1036 wrote to memory of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76
PID 1036 wrote to memory of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76
PID 1036 wrote to memory of 3120	1036	9364b232d5ef553f6df20e977e1a9ca2.exe	76

C:\Users\Admin\AppData\Local\Temp\9364b232d5ef553f6df20e977e1a9ca2.exe
"C:\Users\Admin\AppData\Local\Temp\9364b232d5ef553f6df20e977e1a9ca2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3120

memory/3120-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download