lokibot | bd22e6fdeaeeb5047191e6b7feaeb3a152f43b20b9d464eb51add07c29a1e8de

Analysis

Target

INV-Impot Dos_pdf.exe
Size

890KB
MD5

deebff890e5a3cf56143a8e5f70c494e
SHA1

c48ca3466b49887848ddd36db47265fb3918ba21
SHA256

bd22e6fdeaeeb5047191e6b7feaeb3a152f43b20b9d464eb51add07c29a1e8de
SHA512

fb790cfb50b58d5100c5997a8faaafc7410d2e52e137990fc2e08358761bbe1dfe1466e2000cc464e22c6191075bdf64202af8fc24b3268875b5bec0be5203e1

Score

10^/10

Family

lokibot

https://optimize-apiv2.barantum.com/xx/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

INV-Impot Dos_pdf.exe

description pid process target process

PID 1820 set thread context of 668 1820 INV-Impot Dos_pdf.exe INV-Impot Dos_pdf.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

INV-Impot Dos_pdf.exe

pid process

668 INV-Impot Dos_pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

INV-Impot Dos_pdf.exe

description pid process

Token: SeDebugPrivilege 668 INV-Impot Dos_pdf.exe

description	pid	process	target process
PID 1820 set thread context of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe

pid	process
668	INV-Impot Dos_pdf.exe

description	pid	process
Token: SeDebugPrivilege	668	INV-Impot Dos_pdf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

INV-Impot Dos_pdf.exe

description	pid	process	target process
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe
PID 1820 wrote to memory of 668	1820	INV-Impot Dos_pdf.exe	INV-Impot Dos_pdf.exe

memory/668-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/668-67-0x00000000004139DE-mapping.dmp

Download
memory/668-68-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/668-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1820-60-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1820-62-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/1820-63-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/1820-64-0x0000000005DF0000-0x0000000005E7F000-memory.dmp

Filesize
572KB

Download
memory/1820-65-0x00000000052D0000-0x0000000005312000-memory.dmp

Filesize
264KB

Download