Overview
overview
10Static
static
10Loki 1.8/B...me.exe
windows7-x64
10Loki 1.8/B...me.exe
windows10-2004-x64
10Loki 1.8/C...V2.dll
windows7-x64
1Loki 1.8/C...V2.dll
windows10-2004-x64
1Loki 1.8/L...al.exe
windows7-x64
1Loki 1.8/L...al.exe
windows10-2004-x64
1Loki 1.8/M...UI.dll
windows7-x64
1Loki 1.8/M...UI.dll
windows10-2004-x64
1Loki 1.8/N...ty.dll
windows7-x64
1Loki 1.8/N...ty.dll
windows10-2004-x64
1Panel/five...ss.ps1
windows7-x64
3Panel/five...ss.ps1
windows10-2004-x64
3Panel/five...ss.ps1
windows7-x64
3Panel/five...ss.ps1
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ss.ps1
windows7-x64
3Panel/five...ss.ps1
windows10-2004-x64
3Panel/five...ss.ps1
windows7-x64
3Panel/five...ss.ps1
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ass.js
windows7-x64
3Panel/five...ass.js
windows10-2004-x64
3Panel/five...ss.ps1
windows7-x64
3Panel/five...ss.ps1
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 13:39
Behavioral task
behavioral1
Sample
Loki 1.8/Builder_Lifetime.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Loki 1.8/Builder_Lifetime.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Loki 1.8/CookComputing.XmlRpcV2.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Loki 1.8/CookComputing.XmlRpcV2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Loki 1.8/Loki_original.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Loki 1.8/Loki_original.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Loki 1.8/MRG.Controls.UI.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Loki 1.8/MRG.Controls.UI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Loki 1.8/NReadability.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Loki 1.8/NReadability.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Panel/five/inc/class/misc.class.ps1
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Panel/five/inc/class/misc.class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Panel/five/inc/class/mysqli.class.ps1
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Panel/five/inc/class/mysqli.class.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Panel/five/inc/class/pCharts/class/pBarcode128.class.js
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
Panel/five/inc/class/pCharts/class/pBarcode128.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Panel/five/inc/class/pCharts/class/pBarcode39.class.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Panel/five/inc/class/pCharts/class/pBarcode39.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Panel/five/inc/class/pCharts/class/pBubble.class.js
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
Panel/five/inc/class/pCharts/class/pBubble.class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Panel/five/inc/class/pCharts/class/pCache.class.js
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
Panel/five/inc/class/pCharts/class/pCache.class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Panel/five/inc/class/pCharts/class/pData.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Panel/five/inc/class/pCharts/class/pData.class.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Panel/five/inc/class/pCharts/class/pDraw.class.ps1
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
Panel/five/inc/class/pCharts/class/pDraw.class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Panel/five/inc/class/pCharts/class/pImage.class.js
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Panel/five/inc/class/pCharts/class/pImage.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Panel/five/inc/class/pCharts/class/pIndicator.class.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Panel/five/inc/class/pCharts/class/pIndicator.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Panel/five/inc/class/pCharts/class/pPie.class.ps1
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Panel/five/inc/class/pCharts/class/pPie.class.ps1
Resource
win10v2004-20240426-en
General
-
Target
Panel/five/inc/class/pCharts/class/pData.class.ps1
-
Size
30KB
-
MD5
5f125e49f5fb06094f12aa27dbfa31ed
-
SHA1
aff84d0e69f85c91705208029bf88dd8b4d5cacd
-
SHA256
f705add7a7e20a5603b432d97a80170a9d31dc4de449a6a0ce014b4169582b1b
-
SHA512
0b4c073ffbcf8e4c7932c121bde44698656b0ab19dac98692f2e83470510a1829d09eee6418e47237cac115bed25f8d319525f13ad7a2e4fc7876016a3d3c6b8
-
SSDEEP
384:PO7Ex4JPAMRdTXm9KbSX5hyxUgMsS6sz8n8pwvQJxISbcV5s3NA:SExmnzm9KbK58Ojsoz8n8psIISbh2
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1400 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Panel\five\inc\class\pCharts\class\pData.class.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-4-0x000007FEF5A4E000-0x000007FEF5A4F000-memory.dmpFilesize
4KB
-
memory/1400-5-0x000000001B350000-0x000000001B632000-memory.dmpFilesize
2.9MB
-
memory/1400-6-0x0000000002770000-0x0000000002778000-memory.dmpFilesize
32KB
-
memory/1400-7-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB
-
memory/1400-8-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB
-
memory/1400-9-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB
-
memory/1400-10-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB
-
memory/1400-11-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB
-
memory/1400-12-0x000007FEF5790000-0x000007FEF612D000-memory.dmpFilesize
9.6MB