lokibot | d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f

General

Target

QUOTATION22110577.exe
Size

394KB
MD5

025c9e5be7bf95f51225106ef7e7f7b9
SHA1

c080a077177bd72e4e05d6edba282b7ca5b026e2
SHA256

d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f
SHA512

9564652112dc3f13dee4ffbc49f2dce62a2dfc17e0698d216f408253531867579af29f3b62b6cd0419d7cacaa67f65aafd52c9d2f3a833455532aa26f8310817

Score

10^/10

Family

lokibot

C2

http://greenitylogistics.com/scss/bootstrap/mixinss/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION22110577.exe

description pid process target process

PID 2260 set thread context of 2740 2260 QUOTATION22110577.exe QUOTATION22110577.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

QUOTATION22110577.exe

pid process

2740 QUOTATION22110577.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QUOTATION22110577.exe

description pid process

Token: SeDebugPrivilege 2740 QUOTATION22110577.exe

description	pid	process	target process
PID 2260 set thread context of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe

pid	process
2740	QUOTATION22110577.exe

description	pid	process
Token: SeDebugPrivilege	2740	QUOTATION22110577.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

QUOTATION22110577.exe

description	pid	process	target process
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe
PID 2260 wrote to memory of 2740	2260	QUOTATION22110577.exe	QUOTATION22110577.exe

memory/2260-0-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-1-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2260-3-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/2260-4-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/2260-5-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/2260-6-0x0000000008E90000-0x0000000008E91000-memory.dmp

Filesize
4KB

Download
memory/2260-7-0x0000000008960000-0x0000000008961000-memory.dmp

Filesize
4KB

Download
memory/2260-8-0x00000000057F0000-0x0000000005804000-memory.dmp

Filesize
80KB

Download
memory/2260-9-0x0000000007180000-0x00000000071C5000-memory.dmp

Filesize
276KB

Download
memory/2740-10-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2740-11-0x00000000004139DE-mapping.dmp

Download
memory/2740-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download