65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015

General

Target

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Size

104KB
MD5

04f11f645c82ce66ef89bbc8cd14dbd4
SHA1

52cddf036fe902f7dc31ba9faf71f76de236dd04
SHA256

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015
SHA512

1c2c831bf645377f60160e85570d0ff448c70a26f43380a6778fc355dc68a4a3786288ccc5a164e0eb7620cfb565cf2737402a75cab50d3255e8bc6fa3837006
SSDEEP

1536:PSSSOiNqnTeh6hC8bwT+lyHcw1vjzVj+xakAyBGIs7oJd:KlkTehGwT+lyHB5XN+x9s7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeluokie.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	luokie.exe

Executes dropped EXE 1 IoCs

Processes:

luokie.exe

pid process

2956 luokie.exe

pid	process
2956	luokie.exe

Loads dropped DLL 2 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

pid	process
2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

luokie.exe65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /u"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /b"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /h"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /l"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /e"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /q"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /m"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /d"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /o"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /p"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /v"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /i"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /j"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /w"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /s"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /y"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /k"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /f"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /c"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /u"	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /t"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /a"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /r"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /z"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /x"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /n"	luokie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\luokie = "C:\\Users\\Admin\\luokie.exe /g"	luokie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeluokie.exe

pid	process
2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe
2956	luokie.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeluokie.exe

pid process

2912 65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
2956 luokie.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

description	pid	process	target process
PID 2912 wrote to memory of 2956	2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	luokie.exe
PID 2912 wrote to memory of 2956	2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	luokie.exe
PID 2912 wrote to memory of 2956	2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	luokie.exe
PID 2912 wrote to memory of 2956	2912	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	luokie.exe

C:\Users\Admin\AppData\Local\Temp\65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
"C:\Users\Admin\AppData\Local\Temp\65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\luokie.exe
"C:\Users\Admin\luokie.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\luokie.exe

Filesize
104KB

MD5
34336d718de93c8210f01395876c2175

SHA1
ae9722d799fada43d5068aad44ae32c642cf962f

SHA256
5f19d75ecbb5239279d41f484b4a92c3f2cc29f8686cf686cd17d8131a4748d6

SHA512
7b4964fde0662f412b651e8673b414ee6e5cf6593ce6378d58e0e0597ae78e13986cf29738cbd0afafc2dd2c45e3069c38a31cbe52207198d8703fdbd7ba7fd2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads