lokibot | 606e962ab5babddf8616a2e9596d0312fae466cc2529dca4ab5f44d0f4863902

General

Target

file.exe
Size

875KB
MD5

ee3d3372977f96a7eb777e7cb1a49517
SHA1

d57cb7e62bed15d778e026ed0b8af9fa38be951f
SHA256

606e962ab5babddf8616a2e9596d0312fae466cc2529dca4ab5f44d0f4863902
SHA512

98daffb5261938a9b1fe5e4a45e77077a27de31527a7a5c396c3b1b1bd7c44e6804de3461d9e366c87534f49aaf351466c2082163f47c7f9166810550ba4ec4f

Score

10^/10

Family

lokibot

C2

http://zunlen.com/kin/kin4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 416 set thread context of 3580 416 file.exe file.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

416 file.exe
416 file.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

file.exe

pid process

3580 file.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

file.exefile.exe

description pid process

Token: SeDebugPrivilege 416 file.exe
Token: SeDebugPrivilege 3580 file.exe

description	pid	process	target process
PID 416 set thread context of 3580	416	file.exe	file.exe

pid	process
416	file.exe
416	file.exe

pid	process
3580	file.exe

description	pid	process
Token: SeDebugPrivilege	416	file.exe
Token: SeDebugPrivilege	3580	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 416 wrote to memory of 2260	416	file.exe	file.exe
PID 416 wrote to memory of 2260	416	file.exe	file.exe
PID 416 wrote to memory of 2260	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe
PID 416 wrote to memory of 3580	416	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
PID:2260

memory/416-2-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/416-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/416-5-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/416-6-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/416-7-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/416-8-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/416-9-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/416-10-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/416-11-0x00000000053D0000-0x00000000053F3000-memory.dmp

Filesize
140KB

Download
memory/416-12-0x0000000005E40000-0x0000000005E99000-memory.dmp

Filesize
356KB

Download
memory/3580-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3580-14-0x00000000004139DE-mapping.dmp

Download
memory/3580-15-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download