lokibot | 45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51

General

Target

917dc0ea02f9597e9d43236fa9f7d637.exe
Size

697KB
MD5

917dc0ea02f9597e9d43236fa9f7d637
SHA1

e8904f56591df4148ac911e9851e073a90a120f2
SHA256

45ce5d0d1198fd183287729fd73b38c417180d9972d95c21dceecdf2990f6b51
SHA512

0e8250130083e8343e8039fa06ad60dacda573eb076adaa047639f866e01461939c5cf83c1ece2988d0e5cc4baf63d0b6a105b402abe303255ee9f84695b6021

Score

10^/10

Family

lokibot

C2

http://63.141.228.141/32.php/S4wFP8QBww9Tp

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

917dc0ea02f9597e9d43236fa9f7d637.exe

description pid process target process

PID 320 set thread context of 1800 320 917dc0ea02f9597e9d43236fa9f7d637.exe 917dc0ea02f9597e9d43236fa9f7d637.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

917dc0ea02f9597e9d43236fa9f7d637.exe

pid process

1800 917dc0ea02f9597e9d43236fa9f7d637.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

917dc0ea02f9597e9d43236fa9f7d637.exe

description pid process

Token: SeDebugPrivilege 1800 917dc0ea02f9597e9d43236fa9f7d637.exe

description	pid	process	target process
PID 320 set thread context of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe

pid	process
1800	917dc0ea02f9597e9d43236fa9f7d637.exe

description	pid	process
Token: SeDebugPrivilege	1800	917dc0ea02f9597e9d43236fa9f7d637.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

917dc0ea02f9597e9d43236fa9f7d637.exe

description	pid	process	target process
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe
PID 320 wrote to memory of 1800	320	917dc0ea02f9597e9d43236fa9f7d637.exe	917dc0ea02f9597e9d43236fa9f7d637.exe

memory/320-59-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/320-61-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/320-62-0x0000000000670000-0x0000000000680000-memory.dmp

Filesize
64KB

Download
memory/320-63-0x0000000005640000-0x00000000056D8000-memory.dmp

Filesize
608KB

Download
memory/320-64-0x0000000004760000-0x00000000047C7000-memory.dmp

Filesize
412KB

Download
memory/1800-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1800-66-0x00000000004139DE-mapping.dmp

Download
memory/1800-67-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1800-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download