lokibot | cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

Analysis

Target

iZdmfQkBlqMmmbz.exe
Size

536KB
MD5

2402f165befaa33e3700592cb7defe4c
SHA1

e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
SHA256

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
SHA512

ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

Score

10^/10

Family

lokibot

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description pid process target process

PID 1340 set thread context of 1556 1340 iZdmfQkBlqMmmbz.exe iZdmfQkBlqMmmbz.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

pid process

1556 iZdmfQkBlqMmmbz.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description pid process

Token: SeDebugPrivilege 1556 iZdmfQkBlqMmmbz.exe

description	pid	process	target process
PID 1340 set thread context of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe

pid	process
1556	iZdmfQkBlqMmmbz.exe

description	pid	process
Token: SeDebugPrivilege	1556	iZdmfQkBlqMmmbz.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description	pid	process	target process
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 1340 wrote to memory of 1556	1340	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe

memory/1340-59-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/1340-61-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1340-62-0x00000000004A0000-0x00000000004A2000-memory.dmp

Filesize
8KB

Download
memory/1340-63-0x0000000004E10000-0x0000000004E7B000-memory.dmp

Filesize
428KB

Download
memory/1340-64-0x0000000000680000-0x00000000006A2000-memory.dmp

Filesize
136KB

Download
memory/1556-65-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1556-66-0x00000000004139DE-mapping.dmp

Download
memory/1556-67-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1556-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download