lokibot | 13abe3a68449adfe70b9c71c40af6f34d0d5f252b9ec4f7f97ef9b6f4d4634b2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 13:29

Target

견적 사양서.scr
Size

332KB
MD5

89f7e752cb6dbeb5fdfe82a67df3a9bc
SHA1

249a25d0f254b074f8fcba656512a8f4a6101552
SHA256

3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb
SHA512

f9da3e83577828e85930b1551022adb4f3dec5e51e22d84602cd542e59456ea3e98b317ac137b9d010f4fe8b9aef60fd13b592265ebd7a6e298db6145411eacb
SSDEEP

6144:x38aRUwl6wrlMawpfDkCLNObM/hGBYWv3XZIxUY812jk7NguDRO:xH+wjRaNObM/svXe/8CvAs

Score

10^/10

Family

lokibot

http://meridianresourcellc.top/document/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 4828	5040	견적 사양서.scr	89

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89
PID 5040 wrote to memory of 4828	5040	견적 사양서.scr	89

C:\Users\Admin\AppData\Local\Temp\견적 사양서.scr
"C:\Users\Admin\AppData\Local\Temp\견적 사양서.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\견적 사양서.scr
  "C:\Users\Admin\AppData\Local\Temp\견적 사양서.scr"
  2⤵
  PID:4828

memory/4828-9-0x0000000000900000-0x00000000009A2000-memory.dmp

Filesize
648KB

Download
memory/5040-0-0x00000000003C0000-0x000000000041A000-memory.dmp

Filesize
360KB

Download
memory/5040-1-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/5040-2-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/5040-3-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/5040-4-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/5040-5-0x0000000002940000-0x000000000298E000-memory.dmp

Filesize
312KB

Download
memory/5040-6-0x0000000004FF0000-0x000000000508C000-memory.dmp

Filesize
624KB

Download
memory/5040-7-0x0000000004F20000-0x0000000004F28000-memory.dmp

Filesize
32KB

Download
memory/5040-12-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download