lokibot | bf2095a5d7669d89ae49c4d38ec35aeb37e72702f987cc2ef10faa4f63fd6527

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 04:27

Target

588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe
Size

228KB
MD5

588932a4466e7152ae5ee285ae53aa25
SHA1

16fe85fbe49b4c343989f8e55241f06219348bea
SHA256

bf2095a5d7669d89ae49c4d38ec35aeb37e72702f987cc2ef10faa4f63fd6527
SHA512

2a098c96631dc6ef99978e298fec4611e57ce702aa15236d65d1b193be5aa415240b141763e0b7817a5a9cd6fd524b28ec3c6edce2dd92697482f82a3a0063b9
SSDEEP

3072:cfjLajb87as6j5dnPR3OvmsaEgBeEGkoDGXMtOjhaomQqfVuM8SKFoD8FZ6UT6J:yOnGa/j5hVMm8xeMtOwZQqfGSMZFr6

Score

10^/10

Family

lokibot

http://104.250.162.22/panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100
PID 1576 wrote to memory of 3244	1576	588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\588932a4466e7152ae5ee285ae53aa25_JaffaCakes118.exe"
  2⤵
  PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3564

memory/1576-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/1576-1-0x0000000000370000-0x00000000003B2000-memory.dmp

Filesize
264KB

Download
memory/1576-2-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/1576-3-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/1576-4-0x0000000004D40000-0x0000000004D60000-memory.dmp

Filesize
128KB

Download
memory/1576-5-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/1576-6-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1576-7-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/1576-8-0x0000000005E20000-0x0000000005EBC000-memory.dmp

Filesize
624KB

Download
memory/1576-9-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/1576-14-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/3244-12-0x0000000000630000-0x00000000006D2000-memory.dmp

Filesize
648KB

Download