lokibot | 7325e63707cc4aad1cbded752e2ab79caf3c2886c79d53a78bd1a0c5c212f9a3

Analysis

max time kernel
55s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 14:01

Target

8263D738DA041012EF25C65CB3A71DD1.exe
Size

707KB
MD5

8263d738da041012ef25c65cb3a71dd1
SHA1

ee6b41ac18825ed6110da63b94da7da66cde9a7c
SHA256

7325e63707cc4aad1cbded752e2ab79caf3c2886c79d53a78bd1a0c5c212f9a3
SHA512

4cb80a7bfefe85f2d6b0cc4947df730930405e33679264b0f9d4fc5316b31fcc948eae5cab14646ebb375e721e068b3526b7b699f4366d15b4ed8d3e29c1699f
SSDEEP

12288:FZ9pzkLXw40CVCZQOB3pOZIqswLpuJRrWaQkIDKiU:FZ9pzUXL0MkPBZ53wLpUhji

Score

10^/10

Family

lokibot

http://ebnsina.top/evie1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

8263D738DA041012EF25C65CB3A71DD1.exe

description pid process target process

PID 2532 set thread context of 4944 2532 8263D738DA041012EF25C65CB3A71DD1.exe 8263D738DA041012EF25C65CB3A71DD1.exe

description	pid	process	target process
PID 2532 set thread context of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8263D738DA041012EF25C65CB3A71DD1.exe

description	pid	process	target process
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe
PID 2532 wrote to memory of 4944	2532	8263D738DA041012EF25C65CB3A71DD1.exe	8263D738DA041012EF25C65CB3A71DD1.exe

C:\Users\Admin\AppData\Local\Temp\8263D738DA041012EF25C65CB3A71DD1.exe
"C:\Users\Admin\AppData\Local\Temp\8263D738DA041012EF25C65CB3A71DD1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\8263D738DA041012EF25C65CB3A71DD1.exe
  "C:\Users\Admin\AppData\Local\Temp\8263D738DA041012EF25C65CB3A71DD1.exe"
  2⤵
  PID:4944

memory/2532-0-0x0000000000340000-0x00000000003F6000-memory.dmp

Filesize
728KB

Download
memory/2532-1-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/2532-2-0x0000000004DC0000-0x0000000004E0E000-memory.dmp

Filesize
312KB

Download
memory/2532-3-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/2532-4-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/2532-5-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/2532-6-0x0000000005000000-0x000000000509C000-memory.dmp

Filesize
624KB

Download
memory/2532-7-0x0000000004E90000-0x0000000004E98000-memory.dmp

Filesize
32KB

Download
memory/2532-12-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/4944-10-0x0000000000600000-0x00000000006A2000-memory.dmp

Filesize
648KB

Download