lokibot | 38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2024 01:27

Target

38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe
Size

995KB
MD5

cfe05392605f333a1ed9abc7fe992635
SHA1

60e56713191a5ff83cc905debd5a76c80fcd77de
SHA256

38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f
SHA512

7b0e1ba85bbea3ed3e8dc46f265c8b517bec6639e1777e2ebde4e6b336cb547a45c3e01b093d73714df253f45aab7d1635ac213a2bd1f14f70f37fa94e1de96e
SSDEEP

12288:rmeFmKg5mPN3ohe4/35ww17fsur4o23ZY19Uc:uJhXyaUy4og4Kc

Score

10^/10

Family

lokibot

http://serak.top/ugopounds/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5088	1516	WerFault.exe	85

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 1516	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	85
PID 856 wrote to memory of 3980	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	87
PID 856 wrote to memory of 3980	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	87
PID 856 wrote to memory of 3980	856	38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe	87

C:\Users\Admin\AppData\Local\Temp\38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe
"C:\Users\Admin\AppData\Local\Temp\38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 20
    3⤵
    - Program crash
    PID:5088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1516 -ip 1516
1⤵
PID:888

memory/856-0-0x00007FFF2AFB3000-0x00007FFF2AFB5000-memory.dmp

Filesize
8KB

Download
memory/856-1-0x0000017448320000-0x000001744832A000-memory.dmp

Filesize
40KB

Download
memory/856-2-0x0000017462780000-0x00000174627F2000-memory.dmp

Filesize
456KB

Download
memory/856-3-0x00007FFF2AFB0000-0x00007FFF2BA71000-memory.dmp

Filesize
10.8MB

Download
memory/856-5-0x00007FFF2AFB0000-0x00007FFF2BA71000-memory.dmp

Filesize
10.8MB

Download
memory/1516-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download