Overview

overview

10

Static

static

10

Loki 1.8/C...V2.dll

windows7_x64

1

Loki 1.8/C...V2.dll

windows10-2004_x64

1

Loki 1.8/L...al.exe

windows7_x64

1

Loki 1.8/L...al.exe

windows10-2004_x64

1

Loki 1.8/M...UI.dll

windows7_x64

1

Loki 1.8/M...UI.dll

windows10-2004_x64

1

Loki 1.8/N...ty.dll

windows7_x64

1

Loki 1.8/N...ty.dll

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ass.js

windows7_x64

1

Loki 1.8/P...ass.js

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Loki 1.8/P...ss.ps1

windows7_x64

1

Loki 1.8/P...ss.ps1

windows10-2004_x64

1

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    31-05-2022 03:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Loki 1.8/Panel/inc/class/mysqli.class.ps1

  • Size

    76KB

  • MD5

    ee9dbe92dd08c8f3a082ab46103ef4f8

  • SHA1

    cd9beb16a8ceb9403101d77c5c596c657074ff83

  • SHA256

    5eb284f8432c5f442de9bdd5e41ed303aa53f47d5e0da5b8d67e957bbbcacac6

  • SHA512

    93e80b1da8b7f98a431c947bd435fc7f60b5e50a0af2ae9df1ecbd60f1d8ea0a709138cd40bca2ed6157f3a5d6e0ac3a29e358051ba37373315aa6ffc3e52638

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Loki 1.8\Panel\inc\class\mysqli.class.ps1"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1788-54-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1788-55-0x000007FEF31F0000-0x000007FEF3C13000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/1788-56-0x000007FEF2580000-0x000007FEF30DD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1788-57-0x000007FEF3EA0000-0x000007FEF4D7C000-memory.dmp
    Filesize

    14.9MB

    Download
  • memory/1788-58-0x000007FEF31F0000-0x000007FEF3C13000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/1788-60-0x0000000002704000-0x0000000002707000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1788-59-0x000007FEF6620000-0x000007FEF66D2000-memory.dmp
    Filesize

    712KB

    Download
  • memory/1788-61-0x000007FEF2580000-0x000007FEF30DD000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1788-62-0x000007FEFAB80000-0x000007FEFABE9000-memory.dmp
    Filesize

    420KB

    Download
  • memory/1788-63-0x000007FEF6B70000-0x000007FEF6BA2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1788-64-0x000007FEF6570000-0x000007FEF661A000-memory.dmp
    Filesize

    680KB

    Download
  • memory/1788-65-0x000007FEF6310000-0x000007FEF63F5000-memory.dmp
    Filesize

    916KB

    Download
  • memory/1788-67-0x000007FEF5D90000-0x000007FEF60BE000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/1788-66-0x000007FEF5B70000-0x000007FEF5D86000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/1788-68-0x000007FEF61F0000-0x000007FEF6308000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/1788-69-0x000007FEFAD30000-0x000007FEFAD6E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1788-70-0x000007FEF31F0000-0x000007FEF3C13000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/1788-71-0x000007FEF6620000-0x000007FEF66D2000-memory.dmp
    Filesize

    712KB

    Download
  • memory/1788-72-0x0000000002704000-0x0000000002707000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1788-73-0x000007FEF1ED0000-0x000007FEF2575000-memory.dmp
    Filesize

    6.6MB

    Download
  • memory/1788-74-0x000007FEEEE30000-0x000007FEEF67B000-memory.dmp
    Filesize

    8.3MB

    Download
  • memory/1788-75-0x000007FEF5870000-0x000007FEF59DC000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/1788-77-0x000000000270B000-0x000000000272A000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1788-76-0x000007FEF3D00000-0x000007FEF3E95000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1788-78-0x000007FEF3EA0000-0x000007FEF4D7C000-memory.dmp
    Filesize

    14.9MB

    Download
  • memory/1788-79-0x000007FEF2580000-0x000007FEF30DD000-memory.dmp
    Filesize

    11.4MB

    Download