lokibot | 87741cb9e9bf60d262d17f44e9c5b433750ebc82f5eee8f067b7349ba210bdb4

General

Target

7741e4266e8d98231cb6b0b89b1f4e9a.exe
Size

1.0MB
MD5

7741e4266e8d98231cb6b0b89b1f4e9a
SHA1

1b555dee5cfa0c2f77327fb665d80161261029f2
SHA256

87741cb9e9bf60d262d17f44e9c5b433750ebc82f5eee8f067b7349ba210bdb4
SHA512

f9fda162cfdb993e3e60459cd36acca6dc3b727bdb0240785e48f5cb3a6f0c1a8a1e0281c9790c7a75ef36f7be5882b14517c692de4db5597a3960012a6982d6

Score

10^/10

Family

lokibot

C2

http://okpana.com/chief/kev/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

description pid process target process

PID 1932 set thread context of 1844 1932 7741e4266e8d98231cb6b0b89b1f4e9a.exe 7741e4266e8d98231cb6b0b89b1f4e9a.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

pid process

1844 7741e4266e8d98231cb6b0b89b1f4e9a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

description pid process

Token: SeDebugPrivilege 1844 7741e4266e8d98231cb6b0b89b1f4e9a.exe

description	pid	process	target process
PID 1932 set thread context of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe

pid	process
1844	7741e4266e8d98231cb6b0b89b1f4e9a.exe

description	pid	process
Token: SeDebugPrivilege	1844	7741e4266e8d98231cb6b0b89b1f4e9a.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

description	pid	process	target process
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 1932 wrote to memory of 1844	1932	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe

memory/584-12-0x000007FEF5BC0000-0x000007FEF5E3A000-memory.dmp

Filesize
2.5MB

Download
memory/1844-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1844-9-0x00000000004139DE-mapping.dmp

Download
memory/1844-10-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1844-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1932-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1932-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/1932-5-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1932-6-0x0000000000300000-0x0000000000313000-memory.dmp

Filesize
76KB

Download
memory/1932-7-0x0000000005600000-0x0000000005697000-memory.dmp

Filesize
604KB

Download