lokibot | eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de

General

Target

c08c591f773ecee016ad60496e99ac49.exe
Size

806KB
MD5

c08c591f773ecee016ad60496e99ac49
SHA1

6326dac07e8db5d9c4b328e81e806cd9449eca9a
SHA256

eb2734125424d8e94e2d58e988c7edd9aee7e35bea03c884a0336d93e5ac29de
SHA512

834ef514a5e7e1a06cb38fbadc04b62caf80f0a31feb06ad9534799e99ba90a92c6d04bba31c878df84ee9d5f1af35562a533ded54c37d003f9a16009f07d6e8

Score

10^/10

Family

lokibot

C2

http://lmpulsefashion.net/chief/boss/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

description pid process target process

PID 3300 set thread context of 2800 3300 c08c591f773ecee016ad60496e99ac49.exe c08c591f773ecee016ad60496e99ac49.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

pid process

2800 c08c591f773ecee016ad60496e99ac49.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

description pid process

Token: SeDebugPrivilege 2800 c08c591f773ecee016ad60496e99ac49.exe

description	pid	process	target process
PID 3300 set thread context of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe

pid	process
2800	c08c591f773ecee016ad60496e99ac49.exe

description	pid	process
Token: SeDebugPrivilege	2800	c08c591f773ecee016ad60496e99ac49.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c08c591f773ecee016ad60496e99ac49.exe

description	pid	process	target process
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe
PID 3300 wrote to memory of 2800	3300	c08c591f773ecee016ad60496e99ac49.exe	c08c591f773ecee016ad60496e99ac49.exe

memory/2800-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2800-13-0x00000000004139DE-mapping.dmp

Download
memory/2800-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3300-2-0x0000000073300000-0x00000000739EE000-memory.dmp

Filesize
6.9MB

Download
memory/3300-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/3300-5-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3300-6-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/3300-7-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3300-8-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/3300-9-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/3300-10-0x0000000004F90000-0x0000000004FA2000-memory.dmp

Filesize
72KB

Download
memory/3300-11-0x0000000005AC0000-0x0000000005B12000-memory.dmp

Filesize
328KB

Download