Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
19-07-2020 17:22
Static task
static1
Behavioral task
behavioral1
Sample
flokibot_0.0.0.14.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
flokibot_0.0.0.14.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
flokibot_0.0.0.14.vir.exe
-
Size
356KB
-
MD5
992e9518d69039c3ebae4191e1f8b8b6
-
SHA1
3c93cd0ef4c38e4055b88c22bb398dd45a66fb4f
-
SHA256
5668f2f784befed20b52f3d30aa3a9ab374b35a1a853d908ff9ac5c82ddea749
-
SHA512
583a8ce05eca97576a38918be2beede7253b2ebf40afcf762e7c6d0fe5a2e6f5b54726f1bf8d594bed8ac30a06d6c9a5c031092246d7078f3db589b90bf55851
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
flokibot_0.0.0.14.vir.exeflokibot_0.0.0.14.vir.exedescription pid process target process PID 1732 wrote to memory of 3788 1732 flokibot_0.0.0.14.vir.exe cmd.exe PID 1732 wrote to memory of 3788 1732 flokibot_0.0.0.14.vir.exe cmd.exe PID 1732 wrote to memory of 3788 1732 flokibot_0.0.0.14.vir.exe cmd.exe PID 1732 wrote to memory of 2028 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2028 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2028 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 1532 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 1532 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 1532 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 1732 wrote to memory of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 2180 wrote to memory of 3732 2180 flokibot_0.0.0.14.vir.exe explorer.exe PID 2180 wrote to memory of 3732 2180 flokibot_0.0.0.14.vir.exe explorer.exe PID 2180 wrote to memory of 3732 2180 flokibot_0.0.0.14.vir.exe explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2728 2116 WerFault.exe iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2728 WerFault.exe Token: SeBackupPrivilege 2728 WerFault.exe Token: SeDebugPrivilege 2728 WerFault.exe Token: SeSecurityPrivilege 3732 explorer.exe -
Processes:
resource yara_rule behavioral2/memory/2116-1-0x0000000000400000-0x00000000009DC000-memory.dmp upx behavioral2/memory/2116-4-0x0000000000400000-0x00000000009DC000-memory.dmp upx -
Processes:
iexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Privacy iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
flokibot_0.0.0.14.vir.exepid process 1732 flokibot_0.0.0.14.vir.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
flokibot_0.0.0.14.vir.exeWerFault.exeexplorer.exepid process 1732 flokibot_0.0.0.14.vir.exe 1732 flokibot_0.0.0.14.vir.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 2728 WerFault.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
flokibot_0.0.0.14.vir.exeflokibot_0.0.0.14.vir.exedescription pid process target process PID 1732 set thread context of 2116 1732 flokibot_0.0.0.14.vir.exe iexplore.exe PID 1732 set thread context of 2180 1732 flokibot_0.0.0.14.vir.exe flokibot_0.0.0.14.vir.exe PID 2180 set thread context of 3732 2180 flokibot_0.0.0.14.vir.exe explorer.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
flokibot_0.0.0.14.vir.exeexplorer.exepid process 2180 flokibot_0.0.0.14.vir.exe 2180 flokibot_0.0.0.14.vir.exe 2180 flokibot_0.0.0.14.vir.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe 3732 explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 3732 explorer.exe -
Drops startup file 2 IoCs
Processes:
cmd.exeexplorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\izqe.lnk explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 5483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.14.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Deletes itself
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-14-0x000000000040D770-mapping.dmp
-
memory/2116-1-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/2116-2-0x000000000040D770-mapping.dmp
-
memory/2116-4-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/2116-19-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2116-18-0x000000000040D770-mapping.dmp
-
memory/2116-16-0x000000000040D770-mapping.dmp
-
memory/2116-15-0x000000000040D770-mapping.dmp
-
memory/2180-5-0x000000000040131A-mapping.dmp
-
memory/2180-8-0x00000000038F0000-0x00000000038F1000-memory.dmpFilesize
4KB
-
memory/2180-6-0x0000000000400000-0x0000000001D00000-memory.dmpFilesize
25.0MB
-
memory/2180-3-0x0000000000400000-0x0000000001D00000-memory.dmpFilesize
25.0MB
-
memory/2728-9-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/2728-7-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/2728-17-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2728-20-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/3732-11-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/3732-12-0x0000000000620000-mapping.dmp
-
memory/3732-13-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/3788-0-0x0000000000000000-mapping.dmp