lokibot | f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa

Analysis

Target

4mjt6fCkySAbsm1.exe
Size

551KB
MD5

6f91a99c25ae0ba4dbfc5fe127c7ee36
SHA1

1dba39475d7a4279009b87b117f683c398f8245b
SHA256

f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa
SHA512

f30ba3955310d05962e4611061ac88e354d9af83a81619303346c845f8c6fff5b25add2f137f0235270be7f3f43b3df3832c893199caa57233ca35edcb4674d4

Score

10^/10

Family

lokibot

http://zascocs.xyz/cd/ui/fo.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
suricata: ET MALWARE LokiBot Checkin
suricata
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

4mjt6fCkySAbsm1.exe

description pid process target process

PID 748 set thread context of 516 748 4mjt6fCkySAbsm1.exe 4mjt6fCkySAbsm1.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4mjt6fCkySAbsm1.exe

pid process

516 4mjt6fCkySAbsm1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4mjt6fCkySAbsm1.exe

description pid process

Token: SeDebugPrivilege 516 4mjt6fCkySAbsm1.exe

description	pid	process	target process
PID 748 set thread context of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe

pid	process
516	4mjt6fCkySAbsm1.exe

description	pid	process
Token: SeDebugPrivilege	516	4mjt6fCkySAbsm1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4mjt6fCkySAbsm1.exe

description	pid	process	target process
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe
PID 748 wrote to memory of 516	748	4mjt6fCkySAbsm1.exe	4mjt6fCkySAbsm1.exe

memory/516-66-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/516-67-0x00000000004139DE-mapping.dmp

Download
memory/516-68-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/516-69-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/748-60-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/748-62-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/748-63-0x0000000000910000-0x0000000000912000-memory.dmp

Filesize
8KB

Download
memory/748-64-0x0000000004F70000-0x0000000004FDF000-memory.dmp

Filesize
444KB

Download
memory/748-65-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Filesize
136KB

Download