69854674b6ff0ff95664cd8137f440c1eee2fb8abba5ef706d2b7fc90f3d5c7e

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loki 1.8/LokiBuilder.exe
Size 1.7MB
Sample240517-dqbd3aef61
SHA256 9c3bdcffcaa43ebc06ddd4e98b03459d16ee350aede9524208b34fc2da6b3795
MD5 99c58f53aeff09348dabcfc809dcc7ad
SHA1 6b34e74735eb8b797573230391ef93e3b32e893d
SHA512 1e976503ca26d77650eb176e66d94bde5f2253f4a50b9765a7678cacb90e022fc46394010e4324fe558e00854a81b29bad65720364fbef6b13e56db5bbe5299b
SSDEEP 24576:cwb0elgqSMsTup9DcCmk5Q4LLtkKAkPqN6MV6kORv9MiC8ziQg:vd4CFXAkyNOiiC8a
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2060	winped.exe
2960	Loki_original.exe

Loads dropped DLL 3 IoCs

pid	Process
2860	LokiBuilder.exe
2860	LokiBuilder.exe
2860	LokiBuilder.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000c000000015653-5.dat	upx
behavioral3/memory/2060-21-0x0000000000400000-0x000000000055E000-memory.dmp	upx
behavioral3/memory/2060-22-0x0000000000400000-0x000000000055E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	28
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	28
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	28
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	28
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	29
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	29
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	29
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	29

C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\winped.exe
  "C:\Users\Admin\AppData\Local\Temp\winped.exe"
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\Loki_original.exe
  "C:\Users\Admin\AppData\Local\Temp\Loki_original.exe"
  2⤵
  - Executes dropped EXE
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Loki_original.exe

Path \Users\Admin\AppData\Local\Temp\Loki_original.exe
Size 294KB
SHA256 3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd
MD5 5455364b437d431400267a9092d65442
SHA1 e34ddbf5ba33ffff8beca910cb17237553f4bfd1
SHA512 a00fcf59f67062b112139b0ecdb9a65b9e80b63f90a0dcccc088100e65086e91d1cf704e1e48ef6093e5dcbcb996c00d242792fef7aafe220bacf453251f9f0a
SSDEEP 3072:wRb49OzAYn3a5O1mgxbnRQW1FkvHjhUfTEsS1yxrxzAycsFQ2D:wb49lQ1mgxbnRQW1FkvAeQxrxzDBp
MD5 SHA1 SHA512 SSDEEP

Submit Download

winped.exe

Path \Users\Admin\AppData\Local\Temp\winped.exe
Size 1.0MB
SHA256 32584a80a7e6ae0e6adc8bda5cc909be00580a913481190e8eaa0d2d7f738379
MD5 1c53a029699101e070c8e424dc0c7f54
SHA1 97e98a3e049a76b2701c9203abf8b2d3fdfa41f8
SHA512 74719976d9814c2b62a11f843c8c597c8b01d489133a69f340ddb2450fc6339ec68b89738d1c136e45d17c8b68ced31378ef2c6fa3364acf2172abb716feee8e
SSDEEP 24576:livhMQquEFKwOT1LK3FqnL/fW+n73LytuMdiFapYOLXd2Y:lYqrXFKZTk1qnTW+n73LyNjXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2060-21-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2060-22-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2860-0-0x0000000074961000-0x0000000074962000-memory.dmp

Download

memory/2860-2-0x0000000074960000-0x0000000074F0B000-memory.dmp

Download

memory/2860-1-0x0000000074960000-0x0000000074F0B000-memory.dmp

Download

memory/2860-20-0x0000000074960000-0x0000000074F0B000-memory.dmp

Download

memory/2860-19-0x0000000005B30000-0x0000000005C8E000-memory.dmp

Download

memory/2860-18-0x0000000005B30000-0x0000000005C8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads