Overview
overview
10Static
static
10Loki 1.8/C...V2.dll
windows7-x64
1Loki 1.8/C...V2.dll
windows10-2004-x64
1Loki 1.8/L...er.exe
windows7-x64
7Loki 1.8/L...er.exe
windows10-2004-x64
7Loki 1.8/M...UI.dll
windows7-x64
1Loki 1.8/M...UI.dll
windows10-2004-x64
1Loki 1.8/N...ty.dll
windows7-x64
1Loki 1.8/N...ty.dll
windows10-2004-x64
1Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
3Loki 1.8/P...ass.js
windows7-x64
3Loki 1.8/P...ass.js
windows10-2004-x64
3Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Loki 1.8/P...ss.ps1
windows7-x64
3Loki 1.8/P...ss.ps1
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 03:12
Behavioral task
behavioral1
Sample
Loki 1.8/CookComputing.XmlRpcV2.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Loki 1.8/CookComputing.XmlRpcV2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Loki 1.8/LokiBuilder.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Loki 1.8/LokiBuilder.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Loki 1.8/MRG.Controls.UI.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Loki 1.8/MRG.Controls.UI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Loki 1.8/NReadability.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Loki 1.8/NReadability.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Loki 1.8/Panel/inc/class/misc.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Loki 1.8/Panel/inc/class/misc.class.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Loki 1.8/Panel/inc/class/mysqli.class.ps1
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
Loki 1.8/Panel/inc/class/mysqli.class.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBarcode128.class.js
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBarcode128.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBarcode39.class.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBarcode39.class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBubble.class.js
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pBubble.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pCache.class.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pCache.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pData.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pData.class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pDraw.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pDraw.class.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pImage.class.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pImage.class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pIndicator.class.js
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pIndicator.class.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pPie.class.ps1
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pPie.class.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pRadar.class.ps1
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Loki 1.8/Panel/inc/class/pCharts/class/pRadar.class.ps1
Resource
win10v2004-20240426-en
General
-
Target
Loki 1.8/LokiBuilder.exe
-
Size
1.7MB
-
MD5
99c58f53aeff09348dabcfc809dcc7ad
-
SHA1
6b34e74735eb8b797573230391ef93e3b32e893d
-
SHA256
9c3bdcffcaa43ebc06ddd4e98b03459d16ee350aede9524208b34fc2da6b3795
-
SHA512
1e976503ca26d77650eb176e66d94bde5f2253f4a50b9765a7678cacb90e022fc46394010e4324fe558e00854a81b29bad65720364fbef6b13e56db5bbe5299b
-
SSDEEP
24576:cwb0elgqSMsTup9DcCmk5Q4LLtkKAkPqN6MV6kORv9MiC8ziQg:vd4CFXAkyNOiiC8a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LokiBuilder.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation LokiBuilder.exe -
Executes dropped EXE 2 IoCs
Processes:
winped.exeLoki_original.exepid process 4372 winped.exe 3592 Loki_original.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\winped.exe upx behavioral4/memory/4372-14-0x0000000000400000-0x000000000055E000-memory.dmp upx behavioral4/memory/4372-33-0x0000000000400000-0x000000000055E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
LokiBuilder.exedescription pid process target process PID 3228 wrote to memory of 4372 3228 LokiBuilder.exe winped.exe PID 3228 wrote to memory of 4372 3228 LokiBuilder.exe winped.exe PID 3228 wrote to memory of 4372 3228 LokiBuilder.exe winped.exe PID 3228 wrote to memory of 3592 3228 LokiBuilder.exe Loki_original.exe PID 3228 wrote to memory of 3592 3228 LokiBuilder.exe Loki_original.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe"C:\Users\Admin\AppData\Local\Temp\Loki 1.8\LokiBuilder.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\winped.exe"C:\Users\Admin\AppData\Local\Temp\winped.exe"2⤵
- Executes dropped EXE
PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\Loki_original.exe"C:\Users\Admin\AppData\Local\Temp\Loki_original.exe"2⤵
- Executes dropped EXE
PID:3592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294KB
MD55455364b437d431400267a9092d65442
SHA1e34ddbf5ba33ffff8beca910cb17237553f4bfd1
SHA2563ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd
SHA512a00fcf59f67062b112139b0ecdb9a65b9e80b63f90a0dcccc088100e65086e91d1cf704e1e48ef6093e5dcbcb996c00d242792fef7aafe220bacf453251f9f0a
-
Filesize
1.0MB
MD51c53a029699101e070c8e424dc0c7f54
SHA197e98a3e049a76b2701c9203abf8b2d3fdfa41f8
SHA25632584a80a7e6ae0e6adc8bda5cc909be00580a913481190e8eaa0d2d7f738379
SHA51274719976d9814c2b62a11f843c8c597c8b01d489133a69f340ddb2450fc6339ec68b89738d1c136e45d17c8b68ced31378ef2c6fa3364acf2172abb716feee8e