lokibot | 32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff

General

Target

Detalles de pago PROVV0003654043.pdf.exe
Size

393KB
MD5

4d85e6c70760761a009957e9db240df0
SHA1

729128422d7b4c6939f13a4f9f19b72976222a01
SHA256

32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff
SHA512

acac07d01c08eec2e9d65642acc2ff7b9f850f30d753f16c9081826834e7f8282e9ef1109d1129e8f9cc6c176a430daf8fafced964825820027d958010ecf6eb

Score

10^/10

Family

lokibot

C2

http://ccjjlogsx.com/uu/me/ii.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

Detalles de pago PROVV0003654043.pdf.exe

description	pid	process	target process
PID 3424 set thread context of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

Detalles de pago PROVV0003654043.pdf.exe

pid process

1348 Detalles de pago PROVV0003654043.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Detalles de pago PROVV0003654043.pdf.exe

description pid process

Token: SeDebugPrivilege 1348 Detalles de pago PROVV0003654043.pdf.exe

pid	process
1348	Detalles de pago PROVV0003654043.pdf.exe

description	pid	process
Token: SeDebugPrivilege	1348	Detalles de pago PROVV0003654043.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Detalles de pago PROVV0003654043.pdf.exe

description	pid	process	target process
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe
PID 3424 wrote to memory of 1348	3424	Detalles de pago PROVV0003654043.pdf.exe	Detalles de pago PROVV0003654043.pdf.exe

memory/1348-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1348-125-0x00000000004139DE-mapping.dmp

Download
memory/1348-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3424-114-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3424-116-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3424-117-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/3424-118-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/3424-119-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/3424-120-0x0000000004E10000-0x0000000004E12000-memory.dmp

Filesize
8KB

Download
memory/3424-121-0x00000000064D0000-0x00000000064D1000-memory.dmp

Filesize
4KB

Download
memory/3424-122-0x0000000008200000-0x000000000826C000-memory.dmp

Filesize
432KB

Download
memory/3424-123-0x0000000007F20000-0x0000000007F3F000-memory.dmp

Filesize
124KB

Download