lokibot | 983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635

General

Target

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe
Size

205KB
MD5

7522cabf14151d09bdf4a77654f34d7d
SHA1

67339934cc8096ea6c4603a3c2a4bf4db0b58069
SHA256

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635
SHA512

f2a2452118012594142b8cc684c3a160ace2215e24270f00d7b8a6d60765dc4536745d16dde1ef13350e03e849f8628e5ac624d8eea7c5732eebb901638e7d69

Score

10^/10

Family

lokibot

C2

http://45.133.1.20/health12/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

Processes:

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

description	pid	process	target process
PID 3864 set thread context of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

pid process

3864 983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

description pid process

Token: SeDebugPrivilege 3864 983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

pid	process
3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

description	pid	process
Token: SeDebugPrivilege	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe

description	pid	process	target process
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe
PID 3864 wrote to memory of 1480	3864	983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe
"C:\Users\Admin\AppData\Local\Temp\983510df5d225cfe14e5d5a8a1f5991c8879de5ae0dcdda84f80f7107094e635.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1480

memory/1480-135-0x0000000000000000-mapping.dmp

Download
memory/1480-137-0x0000000000800000-0x00000000008A2000-memory.dmp

Filesize
648KB

Download
memory/3864-130-0x0000000000E90000-0x0000000000ECA000-memory.dmp

Filesize
232KB

Download
memory/3864-131-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/3864-132-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/3864-133-0x0000000005970000-0x0000000005A0C000-memory.dmp

Filesize
624KB

Download
memory/3864-134-0x0000000005E70000-0x0000000005E7A000-memory.dmp

Filesize
40KB

Download