lokibot | 5d1391ea80cf7ee1224e6aad2efd55001e56254a24f217b674963b930e7fb2f4

Analysis

Target

DOCUMENT.EXE
Size

952KB
MD5

ad08c92ae55a9e4012e2cfc6f37cd89f
SHA1

7cf08e1b6a8026060a70de0da3bc4f4dedf7daa5
SHA256

887f31546a3f8f121475b862fbbb75cea8b515464a09c4f64e9add56792718c3
SHA512

b9c87b5acc3dc64170f0a3b41a27237d06077a0acfc652e70f51bee457811c1145aeac9aaba7c1ebe954229798142c57cceba80350a11c6a212ad88fdcc93f9a

Score

10^/10

Family

lokibot

http://63.141.228.141/32.php/209hwrrIygNFO

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOCUMENT.EXE

description pid process target process

PID 1656 set thread context of 768 1656 DOCUMENT.EXE DOCUMENT.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

DOCUMENT.EXE

pid process

768 DOCUMENT.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DOCUMENT.EXE

description pid process

Token: SeDebugPrivilege 768 DOCUMENT.EXE

description	pid	process	target process
PID 1656 set thread context of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE

pid	process
768	DOCUMENT.EXE

description	pid	process
Token: SeDebugPrivilege	768	DOCUMENT.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

DOCUMENT.EXE

description	pid	process	target process
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE
PID 1656 wrote to memory of 768	1656	DOCUMENT.EXE	DOCUMENT.EXE

memory/768-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/768-66-0x00000000004139DE-mapping.dmp

Download
memory/768-67-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/768-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1656-59-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1656-61-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/1656-62-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/1656-63-0x0000000005130000-0x00000000051AE000-memory.dmp

Filesize
504KB

Download
memory/1656-64-0x0000000004900000-0x000000000494C000-memory.dmp

Filesize
304KB

Download