lokibot | f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511

General

Target

Conan Fegan - Aluminium.exe
Size

389KB
MD5

708ee64939578fbb07010e20f6c7672c
SHA1

335dc9a9142b528848b8446be2afda844f6d673f
SHA256

f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511
SHA512

0760e722df49e3a10b26320b54648029c1d7e2862bca7f1bc4d9a60cf9a46a6d847eb3a86825ea1faa59aaa93725d601cee8c3167f4a8fe01ff4454e823fec9a

Score

10^/10

Family

lokibot

C2

https://www.ritcophysiotherapy.com.au/wap121/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

description pid process target process

PID 548 set thread context of 1524 548 Conan Fegan - Aluminium.exe Conan Fegan - Aluminium.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

pid process

1524 Conan Fegan - Aluminium.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

description pid process

Token: SeDebugPrivilege 1524 Conan Fegan - Aluminium.exe

description	pid	process	target process
PID 548 set thread context of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe

pid	process
1524	Conan Fegan - Aluminium.exe

description	pid	process
Token: SeDebugPrivilege	1524	Conan Fegan - Aluminium.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Conan Fegan - Aluminium.exe

description	pid	process	target process
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 548 wrote to memory of 1524	548	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe

memory/548-2-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/548-3-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/548-5-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/548-6-0x00000000002A0000-0x00000000002A3000-memory.dmp

Filesize
12KB

Download
memory/548-7-0x0000000000680000-0x00000000006C2000-memory.dmp

Filesize
264KB

Download
memory/1524-8-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1524-9-0x00000000004139DE-mapping.dmp

Download
memory/1524-10-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1524-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1996-11-0x000007FEF8800000-0x000007FEF8A7A000-memory.dmp

Filesize
2.5MB

Download