lokibot | 0006f7b92348baf0f9da231dc6553defe4e9ce190eff4f1617b81cc3fabbce86

Analysis

Target

3HPbPt1C3AHy1z1.exe
Size

737KB
MD5

2326bda19645c06e4f99aeb8b740cbc1
SHA1

592467238289914c031935cf2c418dc38a14b818
SHA256

0006f7b92348baf0f9da231dc6553defe4e9ce190eff4f1617b81cc3fabbce86
SHA512

131bb52086e0e7f5e571ecc3ba7f2edeca2dae9dd5f987762a61152fef70922063e06b75a88bd268e7e53a8ce9a6d195f9e99deb49f3f00e9e2bb2fba9701980

Score

10^/10

Family

lokibot

http://paciflxinc.com/zoro/zoro1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

3HPbPt1C3AHy1z1.exe

description pid process target process

PID 1192 set thread context of 3672 1192 3HPbPt1C3AHy1z1.exe 3HPbPt1C3AHy1z1.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3HPbPt1C3AHy1z1.exe

pid process

3672 3HPbPt1C3AHy1z1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3HPbPt1C3AHy1z1.exe

description pid process

Token: SeDebugPrivilege 3672 3HPbPt1C3AHy1z1.exe

description	pid	process	target process
PID 1192 set thread context of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe

pid	process
3672	3HPbPt1C3AHy1z1.exe

description	pid	process
Token: SeDebugPrivilege	3672	3HPbPt1C3AHy1z1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3HPbPt1C3AHy1z1.exe

description	pid	process	target process
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe
PID 1192 wrote to memory of 3672	1192	3HPbPt1C3AHy1z1.exe	3HPbPt1C3AHy1z1.exe

memory/1192-2-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/1192-3-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1192-5-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/1192-6-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/1192-7-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/1192-8-0x0000000004D20000-0x0000000004D2E000-memory.dmp

Filesize
56KB

Download
memory/1192-9-0x0000000007010000-0x000000000708A000-memory.dmp

Filesize
488KB

Download
memory/1192-10-0x0000000007140000-0x0000000007141000-memory.dmp

Filesize
4KB

Download
memory/3672-12-0x00000000004139DE-mapping.dmp

Download
memory/3672-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3672-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download