Resubmissions
28/01/2024, 15:06
240128-sg3jhsdhgm628/01/2024, 15:00
240128-sdn7qacba7626/01/2024, 12:16
240126-pfs2xaegbk1026/01/2024, 12:02
240126-n7p9nadbb2117/01/2024, 19:57
240117-yn88jadfbj517/01/2024, 19:56
240117-ynp5naebg9116/01/2024, 18:32
240116-w6l5lshdb76Analysis
- max time kernel
1194s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - submitted
17/01/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
npp.8.6.portable.x64/notepad.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
1200 seconds
General
- Target npp.8.6.portable.x64/notepad.exe
- Sample240117-yn88jadfbj
Score
10/10
Malware Config
Extracted
Family
-
wikiloader
C2
-
https://thichgiban.com/8sjdtu.php?id=1
-
https://kashmirworldwide.com/ilw4kl.php?id=1
-
https://thekostenfamilys.com/m1b7o3.php?id=1
-
https://multitraders.net/yv7clr.php?id=1
Signatures
- Wikiloader
Wikiloader is a loader and backdoor written in C++.
- Wikiloader family
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 728 notepad.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 728 notepad.exe 728 notepad.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 728 notepad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47 PID 728 wrote to memory of 3440 728 notepad.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\npp.8.6.portable.x64\notepad.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.6.portable.x64\notepad.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:728
-