lokibot | dab1d46327d46ccbade543f499379b66a9c71a392e96f3aa29f988301bc8b656

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 08:14

Target

9ebf8487ee2a54513df4a1bb442aa3fc.exe
Size

990KB
MD5

9ebf8487ee2a54513df4a1bb442aa3fc
SHA1

980b9b3ea7d88604a855bb2aa2c929c48e92c7c7
SHA256

dab1d46327d46ccbade543f499379b66a9c71a392e96f3aa29f988301bc8b656
SHA512

37574f1e64f33ad04dfa084792d41cca8141511b5e36b6469c0cf09bb13fc42f1f894434962a5e1946719b9cd65c80d4ca629dd30414824a76acfd7cc55f5668
SSDEEP

24576:7xlH0Rs/wyJ++KVqks7PzbthIRrNuevFOPSK80:NlH0Rs/j+FVqkcfthIRrNuevFOPSK

Score

10^/10

Family

lokibot

http://rocheholding.top/evie3/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Suspicious use of SetThreadContext 1 IoCs

Processes:

9ebf8487ee2a54513df4a1bb442aa3fc.exe

description pid process target process

PID 3508 set thread context of 2496 3508 9ebf8487ee2a54513df4a1bb442aa3fc.exe 9ebf8487ee2a54513df4a1bb442aa3fc.exe

description	pid	process	target process
PID 3508 set thread context of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9ebf8487ee2a54513df4a1bb442aa3fc.exe

description	pid	process	target process
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe
PID 3508 wrote to memory of 2496	3508	9ebf8487ee2a54513df4a1bb442aa3fc.exe	9ebf8487ee2a54513df4a1bb442aa3fc.exe

C:\Users\Admin\AppData\Local\Temp\9ebf8487ee2a54513df4a1bb442aa3fc.exe
"C:\Users\Admin\AppData\Local\Temp\9ebf8487ee2a54513df4a1bb442aa3fc.exe"
2⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4584

memory/2496-9-0x0000000000340000-0x00000000003E2000-memory.dmp

Filesize
648KB

Download
memory/3508-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/3508-1-0x0000000000690000-0x000000000078E000-memory.dmp

Filesize
1016KB

Download
memory/3508-2-0x0000000005190000-0x00000000051DE000-memory.dmp

Filesize
312KB

Download
memory/3508-3-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/3508-4-0x00000000052C0000-0x0000000005352000-memory.dmp

Filesize
584KB

Download
memory/3508-5-0x0000000005360000-0x00000000053FC000-memory.dmp

Filesize
624KB

Download
memory/3508-6-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/3508-7-0x0000000005220000-0x0000000005228000-memory.dmp

Filesize
32KB

Download
memory/3508-12-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download