Analysis
- max time kernel
150s - max time network
106s - platform
windows10_x64 - resource
win10v200430 - submitted
19/07/2020, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
flokibot_0.0.0.13.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
flokibot_0.0.0.13.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target flokibot_0.0.0.13.vir.exe
- Size 239KB
- Sample200719-gzfwpk5gba
- SHA256 e43ee2ab62f9dbeb6c3c43c91778308b450f5192c0abb0242bfddb8a65ab883a
- MD5 a11b982bde341475e28d3a2fa96f982a
- SHA1 181fe69fa5f931251771814d2afc7bcd85c6468a
- SHA512 3a7dc19f2f04cd7dc3bf53cc9132da246a18b4b51092757238c18a51cf874e4f7ebda5d11fdd10ebe58558c207144f0824127f25f4af73defee420930b4334d0
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1340 explorer.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe 1340 explorer.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asowadho.lnk explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 744 wrote to memory of 1340 744 flokibot_0.0.0.13.vir.exe 68 PID 744 wrote to memory of 1340 744 flokibot_0.0.0.13.vir.exe 68 PID 744 wrote to memory of 1340 744 flokibot_0.0.0.13.vir.exe 68 - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 744 flokibot_0.0.0.13.vir.exe 744 flokibot_0.0.0.13.vir.exe 744 flokibot_0.0.0.13.vir.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 744 set thread context of 1340 744 flokibot_0.0.0.13.vir.exe 68 - Deletes itself 1 IoCs
pid Process 1340 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.13.vir.exe"C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.13.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:744 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Deletes itself
PID:1340
-