lokibot | 23b61d5cf710aa3b507eab972672572c6a3febb8f70fe81d35541b24cf6462f6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 11:34

Target

IPP_Commercial Terms..exe
Size

302KB
MD5

55888d7c8305ccc5d2547f02ea5efe1b
SHA1

a3c7d3144f89595380d755ef4d806737028458a6
SHA256

572e22283bac84f3439061bf4a127fc5fc3be6c9bb61d0b28190b231098ca9ee
SHA512

035dfd42884a901fb7fc421c8ee21dc91042a971a1cac2a856be3ea3e4d77087c7b67e012bec2f9d7af3a2670d40a716e00772812cdb42f034bf87f1765c0c2b
SSDEEP

6144:1gn8irYJhSC4KdDKoP3I5qAQELNmCIKb:emJh/lI5qAXNmCIK

Score

10^/10

Family

lokibot

http://umarguzardijye.com/work/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2452	2964	IPP_Commercial Terms..exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	IPP_Commercial Terms..exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31
PID 2964 wrote to memory of 2452	2964	IPP_Commercial Terms..exe	31

C:\Users\Admin\AppData\Local\Temp\IPP_Commercial Terms..exe
"C:\Users\Admin\AppData\Local\Temp\IPP_Commercial Terms..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\IPP_Commercial Terms..exe
  "C:\Users\Admin\AppData\Local\Temp\IPP_Commercial Terms..exe"
  2⤵
  PID:2452

memory/2452-5-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2452-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-11-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2452-9-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2452-7-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2452-4-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2452-3-0x0000000000170000-0x0000000000212000-memory.dmp

Filesize
648KB

Download
memory/2964-0-0x0000000073E41000-0x0000000073E42000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x0000000073E40000-0x00000000743EB000-memory.dmp

Filesize
5.7MB

Download
memory/2964-2-0x0000000073E40000-0x00000000743EB000-memory.dmp

Filesize
5.7MB

Download
memory/2964-17-0x0000000073E40000-0x00000000743EB000-memory.dmp

Filesize
5.7MB

Download