Resubmissions

05/02/2023, 08:29

230205-kdqrjscb9z 1

05/02/2023, 08:22

230205-j9rhaagh82 1

Analysis

  • max time kernel
    108s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2023, 08:29

General

  • Target

    NIKO_Loader_Paid/NikoLoader.exe

  • Size

    153KB

  • MD5

    fa1aa5714dd0300dd9377f5cbc5355a3

  • SHA1

    154a4a4e76610ff5157ac529be2779e22eb17c23

  • SHA256

    eb31c6fda4dd58cd73dbaad8066ac6c5e787f28613c834c7e9257f77460faf84

  • SHA512

    a8be47fea14c292c9b03bd520bde9f6cbad75922a7b87f6bebbfe308cd4bf76c6290f164388c4c46156cace3c977299437deb190ef91b136981fef80cedab618

  • SSDEEP

    3072:gLafEiKNHp/nqU9mulR86pL5hm111JlR86N2FFBuohMKYvJ0SSBcaWfZEiietNVs:iu3PyqPf6ftwaHMczQp31Q

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NIKO_Loader_Paid\NikoLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\NIKO_Loader_Paid\NikoLoader.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4368-132-0x0000000000190000-0x00000000001BC000-memory.dmp

    Filesize

    176KB

  • memory/4368-133-0x0000000005360000-0x0000000005904000-memory.dmp

    Filesize

    5.6MB

  • memory/4368-134-0x0000000004C70000-0x0000000004D02000-memory.dmp

    Filesize

    584KB

  • memory/4368-135-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/4368-136-0x0000000004D10000-0x0000000004D1A000-memory.dmp

    Filesize

    40KB

  • memory/4368-137-0x0000000009510000-0x000000000954C000-memory.dmp

    Filesize

    240KB