37b3fa9a0fad103ba7311948f3eff98779253409556488638ffe057e435d812d | Triage

Submit
Reports

Overview

overview

Static

static

3

4d09e2d279...18.exe

windows7-x64

4d09e2d279...18.exe

windows10-2004-x64

$APPDATA/k...60.dll

windows7-x64

1

$APPDATA/k...60.dll

windows10-2004-x64

1

$APPDATA/k...PN.dll

windows7-x64

1

$APPDATA/k...PN.dll

windows10-2004-x64

1

$APPDATA/k...ms.dll

windows7-x64

1

$APPDATA/k...ms.dll

windows10-2004-x64

1

$APPDATA/k...rt.exe

windows7-x64

1

$APPDATA/k...rt.exe

windows10-2004-x64

1

$APPDATA/t...60.dll

windows7-x64

1

$APPDATA/t...60.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/Holotype.dll

windows7-x64

$TEMP/Holotype.dll

windows10-2004-x64

$TEMP/publ...60.dll

windows7-x64

1

$TEMP/publ...60.dll

windows10-2004-x64

1

$TEMP/publ...60.dll

windows7-x64

1

$TEMP/publ...60.dll

windows10-2004-x64

1

$TEMP/publ...ce.dll

windows7-x64

1

$TEMP/publ...ce.dll

windows10-2004-x64

1

$TEMP/publ...UI.dll

windows7-x64

1

$TEMP/publ...UI.dll

windows10-2004-x64

1

$TEMP/publ...UI.dll

windows7-x64

1

$TEMP/publ...UI.dll

windows10-2004-x64

1

$TEMP/publ.../gzexe

ubuntu-18.04-amd64

1

$TEMP/publ.../gzexe

debian-9-armhf

1

$TEMP/publ.../gzexe

debian-9-mips

$TEMP/publ.../gzexe

debian-9-mipsel

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 21:13

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4d09e2d279b49da3985d586565a7a2cf_JaffaCakes118.exe

Resource

win7-20240215-en

lokibot collection spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4d09e2d279b49da3985d586565a7a2cf_JaffaCakes118.exe

Resource

win10v2004-20240508-en

lokibot collection spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

$APPDATA/konto-eroeffnen/constants/47.opends60.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

$APPDATA/konto-eroeffnen/constants/47.opends60.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

$APPDATA/konto-eroeffnen/constants/MFC80JPN.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

$APPDATA/konto-eroeffnen/constants/MFC80JPN.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

$APPDATA/konto-eroeffnen/constants/MicrosoftWindowsCEForms.dll

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

$APPDATA/konto-eroeffnen/constants/MicrosoftWindowsCEForms.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

$APPDATA/konto-eroeffnen/constants/makecert.exe

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

$APPDATA/konto-eroeffnen/constants/makecert.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

$APPDATA/texis/71.opends60.dll

Resource

win7-20240220-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

$APPDATA/texis/71.opends60.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

$TEMP/Holotype.dll

Resource

win7-20240508-en

lokibot spyware stealer trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

$TEMP/Holotype.dll

Resource

win10v2004-20240508-en

lokibot collection spyware stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral19

Sample

$TEMP/public_ftp/42.opends60.dll

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

$TEMP/public_ftp/42.opends60.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

$TEMP/public_ftp/47.opends60.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

$TEMP/public_ftp/47.opends60.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

$TEMP/public_ftp/MicrosoftVisualJUpgradeEngineInterface.dll

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

$TEMP/public_ftp/MicrosoftVisualJUpgradeEngineInterface.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

$TEMP/public_ftp/VB7TLDUI.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

$TEMP/public_ftp/VB7TLDUI.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

$TEMP/public_ftp/VSMigrateUI.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

$TEMP/public_ftp/VSMigrateUI.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

$TEMP/public_ftp/gzexe

Resource

ubuntu1804-amd64-20240508-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

$TEMP/public_ftp/gzexe

Resource

debian9-armhf-20240226-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

$TEMP/public_ftp/gzexe

Resource

debian9-mipsbe-20240418-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

$TEMP/public_ftp/gzexe

Resource

debian9-mipsel-20240226-en

debian-9-mipsel

0 signatures

150 seconds

Report Analysis Logs

General

Target

$APPDATA/texis/71.opends60.dll
Size

49B
MD5

47afaddd615c7585bcaa3998841c07f1
SHA1

a90d4d3796b98e84ebaae1e5525c73760b6d8cde
SHA256

e8292fb07ef7ba6c6cbf970494d14baa6107cd84a8f8a421f16c77e423e0f531
SHA512

05b52ec788b1f996ff9fda517737ba2059ac520234558eb54f0a73668001f87eebacb709c2bd5010c2dfb006d4bf98e178141fd986f8a919ba286ca2a8f720eb

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\texis\71.opends60.dll,#1
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy