Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2024 19:31

General

  • Target

    LOLO.exe

  • Size

    303KB

  • MD5

    087e4fc1f01e0f295ac3873ad541bf56

  • SHA1

    17024ebb6f8135439a491618748ea2bf482d4b9c

  • SHA256

    2c36cc0292ba8775d195d6dc9df68f45e97ba9bc2f4a35a600edb6072a46e010

  • SHA512

    04d6605dd89fef1f715454610443a4212b6ea2d8ebad9041fcdad151a7f73277758573827072eccbf34470c8528c57c359593df98d161c498e7807e2938b080e

  • SSDEEP

    6144:/Xt3T6MDdbICydeBimcmXKhJUPw6kmA1D0Dxp:/XttpcmXKnUo31D+p

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1296484026433146951/82aR0Nt59Eb92ax2wMZUmGit_E6YL5mUsg5RulT8ws8SXcVkvKauDGcyXREEovQ9v_F5

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\LOLO.exe
    "C:\Users\Admin\AppData\Local\Temp\LOLO.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1472
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1472-0-0x00007FFFA2FF3000-0x00007FFFA2FF5000-memory.dmp

      Filesize

      8KB

    • memory/1472-1-0x0000020819390000-0x00000208193E2000-memory.dmp

      Filesize

      328KB

    • memory/1472-32-0x00007FFFA2FF0000-0x00007FFFA3AB1000-memory.dmp

      Filesize

      10.8MB

    • memory/1472-33-0x00007FFFA2FF0000-0x00007FFFA3AB1000-memory.dmp

      Filesize

      10.8MB