lokibot | 606e962ab5babddf8616a2e9596d0312fae466cc2529dca4ab5f44d0f4863902

Analysis

Target

file.exe
Size

875KB
MD5

ee3d3372977f96a7eb777e7cb1a49517
SHA1

d57cb7e62bed15d778e026ed0b8af9fa38be951f
SHA256

606e962ab5babddf8616a2e9596d0312fae466cc2529dca4ab5f44d0f4863902
SHA512

98daffb5261938a9b1fe5e4a45e77077a27de31527a7a5c396c3b1b1bd7c44e6804de3461d9e366c87534f49aaf351466c2082163f47c7f9166810550ba4ec4f

Score

10^/10

Family

lokibot

http://zunlen.com/kin/kin4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1632 set thread context of 792 1632 file.exe file.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

file.exe

pid process

792 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 792 file.exe

description	pid	process	target process
PID 1632 set thread context of 792	1632	file.exe	file.exe

pid	process
792	file.exe

description	pid	process
Token: SeDebugPrivilege	792	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe
PID 1632 wrote to memory of 792	1632	file.exe	file.exe

memory/792-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/792-9-0x00000000004139DE-mapping.dmp

Download
memory/792-10-0x0000000076341000-0x0000000076343000-memory.dmp

Filesize
8KB

Download
memory/792-11-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/844-12-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1632-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1632-3-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/1632-5-0x0000000000330000-0x0000000000353000-memory.dmp

Filesize
140KB

Download
memory/1632-6-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1632-7-0x0000000000BC0000-0x0000000000C19000-memory.dmp

Filesize
356KB

Download