lokibot | 87741cb9e9bf60d262d17f44e9c5b433750ebc82f5eee8f067b7349ba210bdb4

General

Target

7741e4266e8d98231cb6b0b89b1f4e9a.exe
Size

1.0MB
MD5

7741e4266e8d98231cb6b0b89b1f4e9a
SHA1

1b555dee5cfa0c2f77327fb665d80161261029f2
SHA256

87741cb9e9bf60d262d17f44e9c5b433750ebc82f5eee8f067b7349ba210bdb4
SHA512

f9fda162cfdb993e3e60459cd36acca6dc3b727bdb0240785e48f5cb3a6f0c1a8a1e0281c9790c7a75ef36f7be5882b14517c692de4db5597a3960012a6982d6

Score

10^/10

Family

lokibot

C2

http://okpana.com/chief/kev/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

description pid process target process

PID 832 set thread context of 1476 832 7741e4266e8d98231cb6b0b89b1f4e9a.exe 7741e4266e8d98231cb6b0b89b1f4e9a.exe

description	pid	process	target process
PID 832 set thread context of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7741e4266e8d98231cb6b0b89b1f4e9a.exe

description	pid	process	target process
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe
PID 832 wrote to memory of 1476	832	7741e4266e8d98231cb6b0b89b1f4e9a.exe	7741e4266e8d98231cb6b0b89b1f4e9a.exe

C:\Users\Admin\AppData\Local\Temp\7741e4266e8d98231cb6b0b89b1f4e9a.exe
"C:\Users\Admin\AppData\Local\Temp\7741e4266e8d98231cb6b0b89b1f4e9a.exe"
2⤵
PID:1476

memory/832-2-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/832-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/832-5-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/832-6-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/832-7-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/832-8-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/832-9-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/832-10-0x0000000005F40000-0x0000000005F41000-memory.dmp

Filesize
4KB

Download
memory/832-11-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/832-12-0x0000000005850000-0x0000000005863000-memory.dmp

Filesize
76KB

Download
memory/832-13-0x0000000002C40000-0x0000000002CD7000-memory.dmp

Filesize
604KB

Download
memory/1476-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1476-15-0x00000000004139DE-mapping.dmp

Download
memory/1476-16-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download