koiloader | 1afaff9d535168fa7a57117de3388beb5957b2928642d7b099a50618c401be55

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2152ab092cdae3f3478cc22d96c2d3738faf424855e512a64616b61c4c80331c.exe
Size 178KB
Sample240908-b37a6azdkd
SHA256 2152ab092cdae3f3478cc22d96c2d3738faf424855e512a64616b61c4c80331c
MD5 a9191972be4af4f7f982fbc32829cd21
SHA1 04f03d1bb0afeaf76bcb34907b1df8014422e99f
SHA512 b5c0e9300b62e299e6b75750f5e9b7e509cae29ef27cc7790e07db890b30907e3c7c7103bde99dae2dfe02c7b0e2ce1ae795fce184327c886ddaec012f56bdfe
SSDEEP 3072:zCmlA+2TGMF85+bkRG32foUP9GmPe97Uo+0Ht2iSwiVgekOBSDTsAk16Hauq98Nj:2mlV4h8JG3QUz6YNO0fsr1Uap8NsyHdv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

koiloader discovery loader

Malware Config

Extracted

Family

koiloader

http://146.70.158.109/config.php

Attributes

payload_url
https://mayanboats.com/wp-content/uploads

Signatures

KoiLoader
KoiLoader is a malware loader written in C++.
loader koiloader

Detects KoiLoader payload 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5040-0-0x0000000000710000-0x000000000071D000-memory.dmp	family_koi_loader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2152ab092cdae3f3478cc22d96c2d3738faf424855e512a64616b61c4c80331c.exe

C:\Users\Admin\AppData\Local\Temp\2152ab092cdae3f3478cc22d96c2d3738faf424855e512a64616b61c4c80331c.exe
"C:\Users\Admin\AppData\Local\Temp\2152ab092cdae3f3478cc22d96c2d3738faf424855e512a64616b61c4c80331c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5040-0-0x0000000000710000-0x000000000071D000-memory.dmp

Download