lokibot | a8d610f19e96de89a6f0ca74140b1ce763cb5f2cf2755f17ed411f81eed9bf2f

General

Target

0fc7bb462e9828b1d1a8e6eb348496f7.exe
Size

612KB
MD5

0fc7bb462e9828b1d1a8e6eb348496f7
SHA1

2960267bf2e2a31bf2874bda6bc638eb3d0c1d09
SHA256

a8d610f19e96de89a6f0ca74140b1ce763cb5f2cf2755f17ed411f81eed9bf2f
SHA512

a95d2b237c7cdfd74042bd9c8ff04436b4de5fe99bf10f4b9e23f4d95e0bb4000be4e6485cbb84056eaa462faa307d19573e6fb6a2f324cd009855462e9184d2

Score

10^/10

Family

lokibot

C2

http://azzmtool.com/chief/offor/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description pid process target process

PID 1192 set thread context of 3500 1192 0fc7bb462e9828b1d1a8e6eb348496f7.exe 0fc7bb462e9828b1d1a8e6eb348496f7.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

pid process

3500 0fc7bb462e9828b1d1a8e6eb348496f7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description pid process

Token: SeDebugPrivilege 3500 0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process	target process
PID 1192 set thread context of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe

pid	process
3500	0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process
Token: SeDebugPrivilege	3500	0fc7bb462e9828b1d1a8e6eb348496f7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0fc7bb462e9828b1d1a8e6eb348496f7.exe

description	pid	process	target process
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe
PID 1192 wrote to memory of 3500	1192	0fc7bb462e9828b1d1a8e6eb348496f7.exe	0fc7bb462e9828b1d1a8e6eb348496f7.exe

memory/1192-2-0x0000000073A70000-0x000000007415E000-memory.dmp

Filesize
6.9MB

Download
memory/1192-3-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1192-5-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1192-6-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/1192-7-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/1192-8-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1192-9-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/1192-10-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/1192-11-0x0000000005C50000-0x0000000005CA8000-memory.dmp

Filesize
352KB

Download
memory/3500-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3500-13-0x00000000004139DE-mapping.dmp

Download
memory/3500-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download