lokibot | a8d610f19e96de89a6f0ca74140b1ce763cb5f2cf2755f17ed411f81eed9bf2f

General

Target

0fc7bb462e9828b1d1a8e6eb348496f7.exe
Size

612KB
MD5

0fc7bb462e9828b1d1a8e6eb348496f7
SHA1

2960267bf2e2a31bf2874bda6bc638eb3d0c1d09
SHA256

a8d610f19e96de89a6f0ca74140b1ce763cb5f2cf2755f17ed411f81eed9bf2f
SHA512

a95d2b237c7cdfd74042bd9c8ff04436b4de5fe99bf10f4b9e23f4d95e0bb4000be4e6485cbb84056eaa462faa307d19573e6fb6a2f324cd009855462e9184d2

Score

10^/10

Family

lokibot

C2

http://azzmtool.com/chief/offor/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description pid process target process

PID 1088 set thread context of 1564 1088 0fc7bb462e9828b1d1a8e6eb348496f7.exe 0fc7bb462e9828b1d1a8e6eb348496f7.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

pid process

1564 0fc7bb462e9828b1d1a8e6eb348496f7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description pid process

Token: SeDebugPrivilege 1564 0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process	target process
PID 1088 set thread context of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe

pid	process
1564	0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process
Token: SeDebugPrivilege	1564	0fc7bb462e9828b1d1a8e6eb348496f7.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process	target process
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1088 wrote to memory of 1564	1088	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe

memory/756-10-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp

Filesize
2.5MB

Download
memory/1088-2-0x0000000074CC0000-0x00000000753AE000-memory.dmp

Filesize
6.9MB

Download
memory/1088-3-0x0000000001220000-0x0000000001221000-memory.dmp

Filesize
4KB

Download
memory/1088-5-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1088-6-0x0000000004960000-0x00000000049B8000-memory.dmp

Filesize
352KB

Download
memory/1564-8-0x00000000004139DE-mapping.dmp

Download
memory/1564-7-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1564-9-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download