072780a8e01445c4860453048a21ecf956a66a9bc5765065fee827ca6b88b8f6

Analysis

max time kernel
45s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
31-05-2022 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loki 1.8/Panel/inc/class/pCharts/class/pData.class.ps1
Size

30KB
MD5

5f125e49f5fb06094f12aa27dbfa31ed
SHA1

aff84d0e69f85c91705208029bf88dd8b4d5cacd
SHA256

f705add7a7e20a5603b432d97a80170a9d31dc4de449a6a0ce014b4169582b1b
SHA512

0b4c073ffbcf8e4c7932c121bde44698656b0ab19dac98692f2e83470510a1829d09eee6418e47237cac115bed25f8d319525f13ad7a2e4fc7876016a3d3c6b8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

888 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 888 powershell.exe

pid	process
888	powershell.exe

description	pid	process
Token: SeDebugPrivilege	888	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Loki 1.8\Panel\inc\class\pCharts\class\pData.class.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/888-55-0x000007FEF3800000-0x000007FEF4223000-memory.dmp

Filesize
10.1MB

Download
memory/888-56-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp

Filesize
11.4MB

Download
memory/888-57-0x000007FEF4230000-0x000007FEF510C000-memory.dmp

Filesize
14.9MB

Download
memory/888-58-0x000007FEF3800000-0x000007FEF4223000-memory.dmp

Filesize
10.1MB

Download
memory/888-59-0x000007FEF6880000-0x000007FEF6932000-memory.dmp

Filesize
712KB

Download
memory/888-60-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download
memory/888-61-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp

Filesize
11.4MB

Download
memory/888-62-0x000007FEFAB90000-0x000007FEFABF9000-memory.dmp

Filesize
420KB

Download
memory/888-63-0x000007FEFAEC0000-0x000007FEFAEF2000-memory.dmp

Filesize
200KB

Download
memory/888-64-0x000007FEF66E0000-0x000007FEF678A000-memory.dmp

Filesize
680KB

Download
memory/888-65-0x000007FEF65F0000-0x000007FEF66D5000-memory.dmp

Filesize
916KB

Download
memory/888-66-0x000007FEF6120000-0x000007FEF644E000-memory.dmp

Filesize
3.2MB

Download
memory/888-68-0x000007FEF5F00000-0x000007FEF6116000-memory.dmp

Filesize
2.1MB

Download
memory/888-67-0x000007FEF3800000-0x000007FEF4223000-memory.dmp

Filesize
10.1MB

Download
memory/888-70-0x000007FEF64D0000-0x000007FEF65E8000-memory.dmp

Filesize
1.1MB

Download
memory/888-69-0x000007FEF6880000-0x000007FEF6932000-memory.dmp

Filesize
712KB

Download
memory/888-71-0x000007FEFAE50000-0x000007FEFAE8E000-memory.dmp

Filesize
248KB

Download
memory/888-72-0x000007FEF2CA0000-0x000007FEF37FD000-memory.dmp

Filesize
11.4MB

Download
memory/888-73-0x000007FEF5C00000-0x000007FEF5D6C000-memory.dmp

Filesize
1.4MB

Download
memory/888-75-0x000007FEF25F0000-0x000007FEF2C95000-memory.dmp

Filesize
6.6MB

Download
memory/888-76-0x000000000251B000-0x000000000253A000-memory.dmp

Filesize
124KB

Download
memory/888-74-0x000007FEF2450000-0x000007FEF25E5000-memory.dmp

Filesize
1.6MB

Download
memory/888-77-0x000007FEEEA00000-0x000007FEEF24B000-memory.dmp

Filesize
8.3MB

Download
memory/888-78-0x000007FEF4230000-0x000007FEF510C000-memory.dmp

Filesize
14.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads