lokibot | c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12

Analysis

Target

0n4xyK1WyMB3UE2.exe
Size

1.1MB
MD5

825ebfccb4c9e1b2a71f8e931d751aaf
SHA1

9318735795acaca9794a92030492b9c2c5fc0aab
SHA256

c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12
SHA512

6609b39beec7a86d7994a8b3198556ede8a9654ce84d517ccdc58d5d650361a1e369faba05ca5c93ed998355c60d2c17a9031547f5df9a865e42ab644f7f2bf0

Score

10^/10

Family

lokibot

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

0n4xyK1WyMB3UE2.exe

description pid process target process

PID 1816 set thread context of 692 1816 0n4xyK1WyMB3UE2.exe 0n4xyK1WyMB3UE2.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

0n4xyK1WyMB3UE2.exe

pid process

692 0n4xyK1WyMB3UE2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0n4xyK1WyMB3UE2.exe

description pid process

Token: SeDebugPrivilege 692 0n4xyK1WyMB3UE2.exe

description	pid	process	target process
PID 1816 set thread context of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe

pid	process
692	0n4xyK1WyMB3UE2.exe

description	pid	process
Token: SeDebugPrivilege	692	0n4xyK1WyMB3UE2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

0n4xyK1WyMB3UE2.exe

description	pid	process	target process
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe
PID 1816 wrote to memory of 692	1816	0n4xyK1WyMB3UE2.exe	0n4xyK1WyMB3UE2.exe

memory/692-67-0x00000000004139DE-mapping.dmp

Download
memory/692-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/692-68-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/692-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1816-60-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1816-62-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1816-63-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1816-64-0x0000000007EA0000-0x0000000007F4C000-memory.dmp

Filesize
688KB

Download
memory/1816-65-0x0000000004270000-0x00000000042D0000-memory.dmp

Filesize
384KB

Download