Analysis
-
max time kernel
89s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 03:11
General
-
Target
Loki 1.8/Panel/inc/class/mysqli.class.ps1
-
Size
76KB
-
MD5
ee9dbe92dd08c8f3a082ab46103ef4f8
-
SHA1
cd9beb16a8ceb9403101d77c5c596c657074ff83
-
SHA256
5eb284f8432c5f442de9bdd5e41ed303aa53f47d5e0da5b8d67e957bbbcacac6
-
SHA512
93e80b1da8b7f98a431c947bd435fc7f60b5e50a0af2ae9df1ecbd60f1d8ea0a709138cd40bca2ed6157f3a5d6e0ac3a29e358051ba37373315aa6ffc3e52638
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Loki 1.8\Panel\inc\class\mysqli.class.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4268-130-0x00000159240B0000-0x00000159240D2000-memory.dmpFilesize
136KB
-
memory/4268-131-0x00007FFE0F180000-0x00007FFE0FC41000-memory.dmpFilesize
10.8MB
-
memory/4268-132-0x00007FFE0F180000-0x00007FFE0FC41000-memory.dmpFilesize
10.8MB