lokibot | bcba831c8adb8887ed3e7e82cb61482f5f6ff19c4b7d84478b6958999c04879c

General

Target

1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
Size

1.3MB
MD5

4e17636b1b64b2039bae2890d1f85b43
SHA1

1b15c3d1e31b255a45b9c2731f82ac71a866bddd
SHA256

bcba831c8adb8887ed3e7e82cb61482f5f6ff19c4b7d84478b6958999c04879c
SHA512

45ee408ba1958fd645ab58ff0242dacbfdba1711bfac293e8cabadf16a6bce765c3416e086cebffee6bdde91343a3e5a9da6253604a6add25969937043798d04

Score

10^/10

Family

lokibot

C2

http://51.195.53.221/p.php/qElaNgWyezEFV

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

description	pid	process	target process
PID 576 set thread context of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

pid process

1340 1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

description pid process

Token: SeDebugPrivilege 1340 1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

pid	process
1340	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

description	pid	process
Token: SeDebugPrivilege	1340	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

description	pid	process	target process
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe
PID 576 wrote to memory of 1340	576	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe	1b15c3d1e31b255a45b9c2731f82ac71a866bddd.exe

memory/576-2-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/576-3-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/576-5-0x0000000007830000-0x0000000007831000-memory.dmp

Filesize
4KB

Download
memory/576-6-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Filesize
4KB

Download
memory/576-7-0x00000000078D0000-0x00000000078D1000-memory.dmp

Filesize
4KB

Download
memory/576-8-0x00000000077B0000-0x00000000077B1000-memory.dmp

Filesize
4KB

Download
memory/576-9-0x0000000007A30000-0x0000000007A31000-memory.dmp

Filesize
4KB

Download
memory/576-10-0x0000000002D50000-0x0000000002D62000-memory.dmp

Filesize
72KB

Download
memory/576-11-0x0000000005790000-0x00000000057E8000-memory.dmp

Filesize
352KB

Download
memory/1340-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1340-13-0x00000000004139DE-mapping.dmp

Download
memory/1340-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download