lokibot | d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f

Analysis

Target

QUOTATION22110577.exe
Size

394KB
MD5

025c9e5be7bf95f51225106ef7e7f7b9
SHA1

c080a077177bd72e4e05d6edba282b7ca5b026e2
SHA256

d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f
SHA512

9564652112dc3f13dee4ffbc49f2dce62a2dfc17e0698d216f408253531867579af29f3b62b6cd0419d7cacaa67f65aafd52c9d2f3a833455532aa26f8310817

Score

10^/10

Family

lokibot

http://greenitylogistics.com/scss/bootstrap/mixinss/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION22110577.exe

description pid process target process

PID 788 set thread context of 1772 788 QUOTATION22110577.exe QUOTATION22110577.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

QUOTATION22110577.exe

pid process

1772 QUOTATION22110577.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QUOTATION22110577.exe

description pid process

Token: SeDebugPrivilege 1772 QUOTATION22110577.exe

description	pid	process	target process
PID 788 set thread context of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe

pid	process
1772	QUOTATION22110577.exe

description	pid	process
Token: SeDebugPrivilege	1772	QUOTATION22110577.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

QUOTATION22110577.exe

description	pid	process	target process
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 788 wrote to memory of 1772	788	QUOTATION22110577.exe	QUOTATION22110577.exe

memory/788-0-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/788-1-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/788-3-0x0000000000490000-0x00000000004A4000-memory.dmp

Filesize
80KB

Download
memory/788-4-0x00000000042A0000-0x00000000042E5000-memory.dmp

Filesize
276KB

Download
memory/1120-8-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Filesize
2.5MB

Download
memory/1772-5-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1772-6-0x00000000004139DE-mapping.dmp

Download
memory/1772-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download