lokibot | cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

General

Target

iZdmfQkBlqMmmbz.exe
Size

536KB
MD5

2402f165befaa33e3700592cb7defe4c
SHA1

e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
SHA256

cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
SHA512

ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

Score

10^/10

Family

lokibot

C2

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description pid process target process

PID 3492 set thread context of 2288 3492 iZdmfQkBlqMmmbz.exe iZdmfQkBlqMmmbz.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

pid process

2288 iZdmfQkBlqMmmbz.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description pid process

Token: SeDebugPrivilege 2288 iZdmfQkBlqMmmbz.exe

description	pid	process	target process
PID 3492 set thread context of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe

pid	process
2288	iZdmfQkBlqMmmbz.exe

description	pid	process
Token: SeDebugPrivilege	2288	iZdmfQkBlqMmmbz.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iZdmfQkBlqMmmbz.exe

description	pid	process	target process
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe
PID 3492 wrote to memory of 2288	3492	iZdmfQkBlqMmmbz.exe	iZdmfQkBlqMmmbz.exe

memory/2288-124-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2288-125-0x00000000004139DE-mapping.dmp

Download
memory/2288-126-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3492-114-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/3492-116-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/3492-117-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/3492-118-0x0000000004F10000-0x000000000540E000-memory.dmp

Filesize
5.0MB

Download
memory/3492-119-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3492-120-0x0000000005380000-0x0000000005382000-memory.dmp

Filesize
8KB

Download
memory/3492-121-0x0000000008490000-0x0000000008491000-memory.dmp

Filesize
4KB

Download
memory/3492-122-0x0000000006AB0000-0x0000000006B1B000-memory.dmp

Filesize
428KB

Download
memory/3492-123-0x0000000006A00000-0x0000000006A22000-memory.dmp

Filesize
136KB

Download