lokibot | 3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 18:01

Target

D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
Size

726KB
MD5

d0ddfe864c4befa2fcc6d89f9a7a59be
SHA1

d1e13ca84bc0ad0b7f8c167b11b6eeac60d8cd8a
SHA256

3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8
SHA512

e5b6931de75aff79a3aedf99848222b5667ef7d0aa0e7a497a86d8ac4ed2907d7a2f2d217ffc1c737e79998f41113addc3fe1019125b955452b0f80856b20c8c
SSDEEP

12288:38pYTbiUnI+w3363jUfPWL9gokXNuslchJh4l:spY5nILggxcml

Score

10^/10

Family

lokibot

http://tampabayllc.top/teamb/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe

description pid process target process

PID 2896 set thread context of 2864 2896 D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe

description	pid	process	target process
PID 2896 set thread context of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe

description	pid	process	target process
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
PID 2896 wrote to memory of 2864	2896	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe	D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe

C:\Users\Admin\AppData\Local\Temp\D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
"C:\Users\Admin\AppData\Local\Temp\D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe
  "C:\Users\Admin\AppData\Local\Temp\D0DDFE864C4BEFA2FCC6D89F9A7A59BE.exe"
  2⤵
  PID:2864

memory/2864-9-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2864-6-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2864-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2864-13-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2864-8-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2864-7-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2864-5-0x0000000000260000-0x0000000000302000-memory.dmp

Filesize
648KB

Download
memory/2896-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2896-2-0x0000000000CD0000-0x0000000000D1E000-memory.dmp

Filesize
312KB

Download
memory/2896-3-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/2896-4-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/2896-15-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2896-0-0x00000000000F0000-0x00000000001AC000-memory.dmp

Filesize
752KB

Download