lokibot | d6dc11a4e7aa731c34102e7e0077f992c87679fe33ada516eed4cea58622bdd1

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:02

Target

04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
Size

431KB
MD5

eaee5df0875713fd78523ed4fdc30d39
SHA1

e31a30045bfcb92cfc9a80a69bcbe2087078cf0d
SHA256

04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2
SHA512

bf142ec03ee4b671d0333b4c4d1f2f59f7b8a335a61d01da842554a7c6b881d39f784249820403c1ce508e52eefef3e364283cbfa9a740908b0c892253c7c5a1
SSDEEP

6144:j+hiQ1o15sp7QPBTiPqWzD2Kr+dsojcYdKRyMfztIo7xZqpgg4WnU/LBZloAITGZ:y7c1iCFHc1tIwaU/RorHzS352F

Score

10^/10

Family

lokibot

https://sempersim.su/c11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89
PID 3928 wrote to memory of 1540	3928	04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe	89

C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
"C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe
  "C:\Users\Admin\AppData\Local\Temp\04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2.exe"
  2⤵
  PID:1540

memory/1540-9-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download
memory/3928-0-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/3928-1-0x0000000000EF0000-0x0000000000F62000-memory.dmp

Filesize
456KB

Download
memory/3928-3-0x00000000058C0000-0x000000000590E000-memory.dmp

Filesize
312KB

Download
memory/3928-2-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/3928-4-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/3928-5-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Filesize
584KB

Download
memory/3928-6-0x0000000005B60000-0x0000000005BFC000-memory.dmp

Filesize
624KB

Download
memory/3928-7-0x00000000059F0000-0x00000000059F8000-memory.dmp

Filesize
32KB

Download
memory/3928-12-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download