lokibot | 5d1391ea80cf7ee1224e6aad2efd55001e56254a24f217b674963b930e7fb2f4

General

Target

DOCUMENT.EXE
Size

952KB
MD5

ad08c92ae55a9e4012e2cfc6f37cd89f
SHA1

7cf08e1b6a8026060a70de0da3bc4f4dedf7daa5
SHA256

887f31546a3f8f121475b862fbbb75cea8b515464a09c4f64e9add56792718c3
SHA512

b9c87b5acc3dc64170f0a3b41a27237d06077a0acfc652e70f51bee457811c1145aeac9aaba7c1ebe954229798142c57cceba80350a11c6a212ad88fdcc93f9a

Score

10^/10

Family

lokibot

C2

http://63.141.228.141/32.php/209hwrrIygNFO

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOCUMENT.EXE

description pid process target process

PID 1696 set thread context of 4032 1696 DOCUMENT.EXE DOCUMENT.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DOCUMENT.EXE

pid process

1696 DOCUMENT.EXE
1696 DOCUMENT.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

DOCUMENT.EXE

pid process

4032 DOCUMENT.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DOCUMENT.EXEDOCUMENT.EXE

description pid process

Token: SeDebugPrivilege 1696 DOCUMENT.EXE
Token: SeDebugPrivilege 4032 DOCUMENT.EXE

description	pid	process	target process
PID 1696 set thread context of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE

pid	process
1696	DOCUMENT.EXE
1696	DOCUMENT.EXE

pid	process
4032	DOCUMENT.EXE

description	pid	process
Token: SeDebugPrivilege	1696	DOCUMENT.EXE
Token: SeDebugPrivilege	4032	DOCUMENT.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DOCUMENT.EXE

description	pid	process	target process
PID 1696 wrote to memory of 2296	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 2296	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 2296	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE
PID 1696 wrote to memory of 4032	1696	DOCUMENT.EXE	DOCUMENT.EXE

C:\Users\Admin\AppData\Local\Temp\DOCUMENT.EXE
"C:\Users\Admin\AppData\Local\Temp\DOCUMENT.EXE"
2⤵
PID:2296

memory/1696-114-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1696-116-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/1696-117-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/1696-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/1696-119-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/1696-120-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/1696-121-0x0000000004FB0000-0x00000000054AE000-memory.dmp

Filesize
5.0MB

Download
memory/1696-122-0x0000000005480000-0x0000000005490000-memory.dmp

Filesize
64KB

Download
memory/1696-123-0x0000000008730000-0x00000000087AE000-memory.dmp

Filesize
504KB

Download
memory/1696-124-0x000000000AEE0000-0x000000000AF2C000-memory.dmp

Filesize
304KB

Download
memory/4032-126-0x00000000004139DE-mapping.dmp

Download
memory/4032-125-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4032-127-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download