Analysis
-
max time kernel
59s -
max time network
73s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 17:22
Static task
static1
Behavioral task
behavioral1
Sample
flokibot_0.0.0.14.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
flokibot_0.0.0.14.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
flokibot_0.0.0.14.vir.exe
-
Size
356KB
-
MD5
992e9518d69039c3ebae4191e1f8b8b6
-
SHA1
3c93cd0ef4c38e4055b88c22bb398dd45a66fb4f
-
SHA256
5668f2f784befed20b52f3d30aa3a9ab374b35a1a853d908ff9ac5c82ddea749
-
SHA512
583a8ce05eca97576a38918be2beede7253b2ebf40afcf762e7c6d0fe5a2e6f5b54726f1bf8d594bed8ac30a06d6c9a5c031092246d7078f3db589b90bf55851
Score
8/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1108 756 WerFault.exe flokibot_0.0.0.14.vir.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1108 WerFault.exe -
Processes:
resource yara_rule behavioral1/memory/1600-1-0x0000000000400000-0x00000000009DC000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
flokibot_0.0.0.14.vir.exepid process 1544 flokibot_0.0.0.14.vir.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
flokibot_0.0.0.14.vir.exeflokibot_0.0.0.14.vir.exedescription pid process target process PID 1544 wrote to memory of 276 1544 flokibot_0.0.0.14.vir.exe cmd.exe PID 1544 wrote to memory of 276 1544 flokibot_0.0.0.14.vir.exe cmd.exe PID 1544 wrote to memory of 276 1544 flokibot_0.0.0.14.vir.exe cmd.exe PID 1544 wrote to memory of 276 1544 flokibot_0.0.0.14.vir.exe cmd.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1544 wrote to memory of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 756 wrote to memory of 1108 756 flokibot_0.0.0.14.vir.exe WerFault.exe PID 756 wrote to memory of 1108 756 flokibot_0.0.0.14.vir.exe WerFault.exe PID 756 wrote to memory of 1108 756 flokibot_0.0.0.14.vir.exe WerFault.exe PID 756 wrote to memory of 1108 756 flokibot_0.0.0.14.vir.exe WerFault.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
flokibot_0.0.0.14.vir.exeWerFault.exepid process 1544 flokibot_0.0.0.14.vir.exe 1108 WerFault.exe 1108 WerFault.exe 1108 WerFault.exe 1108 WerFault.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
flokibot_0.0.0.14.vir.exedescription pid process target process PID 1544 set thread context of 1600 1544 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1544 set thread context of 756 1544 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/276-0-0x0000000000000000-mapping.dmp
-
memory/756-3-0x0000000000400000-0x0000000001D00000-memory.dmpFilesize
25.0MB
-
memory/756-4-0x000000000040131A-mapping.dmp
-
memory/756-5-0x0000000000400000-0x0000000001D00000-memory.dmpFilesize
25.0MB
-
memory/756-8-0x000000000040131A-mapping.dmp
-
memory/1108-6-0x0000000000000000-mapping.dmp
-
memory/1108-7-0x0000000001E80000-0x0000000001E91000-memory.dmpFilesize
68KB
-
memory/1108-9-0x00000000023F0000-0x0000000002401000-memory.dmpFilesize
68KB
-
memory/1600-1-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/1600-2-0x000000000040D770-mapping.dmp