Overview

overview

7

Static

static

flokibot_0...ir.exe

windows7_x64

7

flokibot_0...ir.exe

windows10_x64

7

Analysis

  • max time kernel
    151s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    19-07-2020 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    flokibot_0.0.0.10.vir.exe

  • Size

    231KB

  • MD5

    c149ef34c57e6f7e970063679de01342

  • SHA1

    855388d354f19322a722c6f9d01e574c9bbf19ae

  • SHA256

    5028124ce748b23e709f1540a7c58310f8481e179aff7986d5cfd693c9af94da

  • SHA512

    d05d3e53c075d87ca274f579322a63836b1304de0436dfa32fd5af7c9a2affc09dcc5433a67fdd2e80ca7f4354e86158e0ea0fa63de72644ef6edb48d0ab53b2

Score
7/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Loads dropped DLL 716 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Drops startup file 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.10.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\flokibot_0.0.0.10.vir.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Deletes itself
      • Suspicious use of AdjustPrivilegeToken
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Drops startup file
      PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads