lokibot | cabcc377f00b0aa676d3139e7f14fa7881c5f25875d5218e25645db7e129992c

General

Target

Standard Chartered Bank.exe
Size

498KB
MD5

810e9eebba5cce5bf0d44cbb5e3b5a19
SHA1

bf031ef4b6b87f9e0cb2c540745614fb914475d4
SHA256

cabcc377f00b0aa676d3139e7f14fa7881c5f25875d5218e25645db7e129992c
SHA512

c6b33f8be189ff612388fd48f0e6bbeafbf7ec57b65133afbffe1484306288ed8dfe568bfe8d8e65b7bea9d819068f52d8dc073e1e9b45c145a338c06a02e9f1

Score

10^/10

Family

lokibot

C2

http://63.141.228.141/32.php/5l0ZnNa7AB6Dl

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

Standard Chartered Bank.exe

description pid process target process

PID 1852 set thread context of 1628 1852 Standard Chartered Bank.exe Standard Chartered Bank.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Standard Chartered Bank.exe

pid process

1852 Standard Chartered Bank.exe
1852 Standard Chartered Bank.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Standard Chartered Bank.exe

pid process

1628 Standard Chartered Bank.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Standard Chartered Bank.exeStandard Chartered Bank.exe

description pid process

Token: SeDebugPrivilege 1852 Standard Chartered Bank.exe
Token: SeDebugPrivilege 1628 Standard Chartered Bank.exe

description	pid	process	target process
PID 1852 set thread context of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe

pid	process
1852	Standard Chartered Bank.exe
1852	Standard Chartered Bank.exe

pid	process
1628	Standard Chartered Bank.exe

description	pid	process
Token: SeDebugPrivilege	1852	Standard Chartered Bank.exe
Token: SeDebugPrivilege	1628	Standard Chartered Bank.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Standard Chartered Bank.exe

description	pid	process	target process
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe
PID 1852 wrote to memory of 1628	1852	Standard Chartered Bank.exe	Standard Chartered Bank.exe

memory/1628-64-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1628-65-0x00000000004139DE-mapping.dmp

Download
memory/1628-66-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1628-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1852-59-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/1852-61-0x00000000001F0000-0x000000000021F000-memory.dmp

Filesize
188KB

Download
memory/1852-62-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/1852-63-0x00000000003F0000-0x0000000000423000-memory.dmp

Filesize
204KB

Download