69854674b6ff0ff95664cd8137f440c1eee2fb8abba5ef706d2b7fc90f3d5c7e

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loki 1.8/LokiBuilder.exe
Size

1.7MB
MD5

99c58f53aeff09348dabcfc809dcc7ad
SHA1

6b34e74735eb8b797573230391ef93e3b32e893d
SHA256

9c3bdcffcaa43ebc06ddd4e98b03459d16ee350aede9524208b34fc2da6b3795
SHA512

1e976503ca26d77650eb176e66d94bde5f2253f4a50b9765a7678cacb90e022fc46394010e4324fe558e00854a81b29bad65720364fbef6b13e56db5bbe5299b
SSDEEP

24576:cwb0elgqSMsTup9DcCmk5Q4LLtkKAkPqN6MV6kORv9MiC8ziQg:vd4CFXAkyNOiiC8a

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

winped.exeLoki_original.exe

pid process

2060 winped.exe
2960 Loki_original.exe
Loads dropped DLL 3 IoCs

Processes:

LokiBuilder.exe

pid process

2860 LokiBuilder.exe
2860 LokiBuilder.exe
2860 LokiBuilder.exe

pid	process
2060	winped.exe
2960	Loki_original.exe

pid	process
2860	LokiBuilder.exe
2860	LokiBuilder.exe
2860	LokiBuilder.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\winped.exe	upx
behavioral3/memory/2060-21-0x0000000000400000-0x000000000055E000-memory.dmp	upx
behavioral3/memory/2060-22-0x0000000000400000-0x000000000055E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

LokiBuilder.exe

description	pid	process	target process
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	winped.exe
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	winped.exe
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	winped.exe
PID 2860 wrote to memory of 2060	2860	LokiBuilder.exe	winped.exe
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	Loki_original.exe
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	Loki_original.exe
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	Loki_original.exe
PID 2860 wrote to memory of 2960	2860	LokiBuilder.exe	Loki_original.exe

C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\winped.exe
"C:\Users\Admin\AppData\Local\Temp\winped.exe"
2⤵
- Executes dropped EXE
PID:2060

C:\Users\Admin\AppData\Local\Temp\Loki_original.exe
"C:\Users\Admin\AppData\Local\Temp\Loki_original.exe"
2⤵
- Executes dropped EXE
PID:2960

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Loki_original.exe
Filesize
294KB

MD5
5455364b437d431400267a9092d65442

SHA1
e34ddbf5ba33ffff8beca910cb17237553f4bfd1

SHA256
3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd

SHA512
a00fcf59f67062b112139b0ecdb9a65b9e80b63f90a0dcccc088100e65086e91d1cf704e1e48ef6093e5dcbcb996c00d242792fef7aafe220bacf453251f9f0a

Download Submit
\Users\Admin\AppData\Local\Temp\winped.exe
Filesize
1.0MB

MD5
1c53a029699101e070c8e424dc0c7f54

SHA1
97e98a3e049a76b2701c9203abf8b2d3fdfa41f8

SHA256
32584a80a7e6ae0e6adc8bda5cc909be00580a913481190e8eaa0d2d7f738379

SHA512
74719976d9814c2b62a11f843c8c597c8b01d489133a69f340ddb2450fc6339ec68b89738d1c136e45d17c8b68ced31378ef2c6fa3364acf2172abb716feee8e

Download Submit
memory/2060-21-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2060-22-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2860-0-0x0000000074961000-0x0000000074962000-memory.dmp

Filesize
4KB

Download
memory/2860-2-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-1-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-20-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-19-0x0000000005B30000-0x0000000005C8E000-memory.dmp

Filesize
1.4MB

Download
memory/2860-18-0x0000000005B30000-0x0000000005C8E000-memory.dmp

Filesize
1.4MB

Download