lokibot | 34ca6d0865baf4fb4bb6427bccf68e5609f5d74c5f277483536570b3951a8d5d

General

Target

Outstanding_SOA_Payment_April_pdf.exe
Size

305KB
MD5

f2ff7f964069c2236a840e23dabaab7e
SHA1

3175a26730edc37b3d8327b76640008466fc7e7c
SHA256

1144e3bae3faea1e5b8e16a8afe431d07743cf87effdbe3b409dff8c9b1c6132
SHA512

5c79d048febda6d07fe241df28e9ff2b5e5124d1104c63c0336bb2335b7af80f9e7081dd74cc6ee1ce966495c10620ab95f462278e15c77158f382543a9177c3

Score

10^/10

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

Outstanding_SOA_Payment_April_pdf.exe

description pid process target process

PID 5048 set thread context of 2720 5048 Outstanding_SOA_Payment_April_pdf.exe Outstanding_SOA_Payment_April_pdf.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Outstanding_SOA_Payment_April_pdf.exe

pid process

5048 Outstanding_SOA_Payment_April_pdf.exe
5048 Outstanding_SOA_Payment_April_pdf.exe
5048 Outstanding_SOA_Payment_April_pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Outstanding_SOA_Payment_April_pdf.exe

description pid process

Token: SeDebugPrivilege 5048 Outstanding_SOA_Payment_April_pdf.exe

description	pid	process	target process
PID 5048 set thread context of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe

pid	process
5048	Outstanding_SOA_Payment_April_pdf.exe
5048	Outstanding_SOA_Payment_April_pdf.exe
5048	Outstanding_SOA_Payment_April_pdf.exe

description	pid	process
Token: SeDebugPrivilege	5048	Outstanding_SOA_Payment_April_pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Outstanding_SOA_Payment_April_pdf.exe

description	pid	process	target process
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe
PID 5048 wrote to memory of 2720	5048	Outstanding_SOA_Payment_April_pdf.exe	Outstanding_SOA_Payment_April_pdf.exe

C:\Users\Admin\AppData\Local\Temp\Outstanding_SOA_Payment_April_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Outstanding_SOA_Payment_April_pdf.exe"
2⤵
PID:2720

memory/2720-135-0x0000000000000000-mapping.dmp

Download
memory/2720-137-0x0000000000790000-0x0000000000832000-memory.dmp

Filesize
648KB

Download
memory/5048-130-0x0000000000260000-0x00000000002B2000-memory.dmp

Filesize
328KB

Download
memory/5048-131-0x0000000005280000-0x0000000005824000-memory.dmp

Filesize
5.6MB

Download
memory/5048-132-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Filesize
584KB

Download
memory/5048-133-0x0000000005B80000-0x0000000005BC4000-memory.dmp

Filesize
272KB

Download
memory/5048-134-0x0000000005930000-0x0000000005952000-memory.dmp

Filesize
136KB

Download