lokibot | f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511

General

Target

Conan Fegan - Aluminium.exe
Size

389KB
MD5

708ee64939578fbb07010e20f6c7672c
SHA1

335dc9a9142b528848b8446be2afda844f6d673f
SHA256

f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511
SHA512

0760e722df49e3a10b26320b54648029c1d7e2862bca7f1bc4d9a60cf9a46a6d847eb3a86825ea1faa59aaa93725d601cee8c3167f4a8fe01ff4454e823fec9a

Score

10^/10

Family

lokibot

C2

https://www.ritcophysiotherapy.com.au/wap121/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

description pid process target process

PID 3884 set thread context of 3644 3884 Conan Fegan - Aluminium.exe Conan Fegan - Aluminium.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

pid process

3644 Conan Fegan - Aluminium.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Conan Fegan - Aluminium.exe

description pid process

Token: SeDebugPrivilege 3644 Conan Fegan - Aluminium.exe

description	pid	process	target process
PID 3884 set thread context of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe

pid	process
3644	Conan Fegan - Aluminium.exe

description	pid	process
Token: SeDebugPrivilege	3644	Conan Fegan - Aluminium.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Conan Fegan - Aluminium.exe

description	pid	process	target process
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe
PID 3884 wrote to memory of 3644	3884	Conan Fegan - Aluminium.exe	Conan Fegan - Aluminium.exe

memory/3644-12-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3644-13-0x00000000004139DE-mapping.dmp

Download
memory/3644-14-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3884-2-0x0000000073A20000-0x000000007410E000-memory.dmp

Filesize
6.9MB

Download
memory/3884-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3884-5-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/3884-6-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/3884-7-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/3884-8-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/3884-9-0x0000000005820000-0x0000000005823000-memory.dmp

Filesize
12KB

Download
memory/3884-10-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/3884-11-0x0000000007120000-0x0000000007162000-memory.dmp

Filesize
264KB

Download