lokibot | 04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 08:40

Target

eaee5df0875713fd78523ed4fdc30d39.exe
Size

431KB
MD5

eaee5df0875713fd78523ed4fdc30d39
SHA1

e31a30045bfcb92cfc9a80a69bcbe2087078cf0d
SHA256

04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2
SHA512

bf142ec03ee4b671d0333b4c4d1f2f59f7b8a335a61d01da842554a7c6b881d39f784249820403c1ce508e52eefef3e364283cbfa9a740908b0c892253c7c5a1
SSDEEP

6144:j+hiQ1o15sp7QPBTiPqWzD2Kr+dsojcYdKRyMfztIo7xZqpgg4WnU/LBZloAITGZ:y7c1iCFHc1tIwaU/RorHzS352F

Score

10^/10

Family

lokibot

https://sempersim.su/c11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28
PID 2128 wrote to memory of 1964	2128	eaee5df0875713fd78523ed4fdc30d39.exe	28

C:\Users\Admin\AppData\Local\Temp\eaee5df0875713fd78523ed4fdc30d39.exe
"C:\Users\Admin\AppData\Local\Temp\eaee5df0875713fd78523ed4fdc30d39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\eaee5df0875713fd78523ed4fdc30d39.exe
  "C:\Users\Admin\AppData\Local\Temp\eaee5df0875713fd78523ed4fdc30d39.exe"
  2⤵
  PID:1964

memory/1964-13-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1964-5-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1964-7-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1964-9-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1964-11-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/1964-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1964-18-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/2128-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2128-2-0x00000000005C0000-0x000000000060E000-memory.dmp

Filesize
312KB

Download
memory/2128-3-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2128-4-0x00000000006D0000-0x00000000006D8000-memory.dmp

Filesize
32KB

Download
memory/2128-0-0x0000000000BF0000-0x0000000000C62000-memory.dmp

Filesize
456KB

Download
memory/2128-19-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download