5068dc04d6350419acdf812588ae28a1cd95c3cad4d7102b3f4b9650abd19a5b

General

Target
2026-09-25_8ca954726c774692a26087cc0e858117_cloudeye_elex_loki-bot.exe
Size 258KB
Sample260925-24v8ds1xhs
SHA256 5068dc04d6350419acdf812588ae28a1cd95c3cad4d7102b3f4b9650abd19a5b
MD5 8ca954726c774692a26087cc0e858117
SHA1 631a188ed8827453b8b773f68ce6789e4f3f9e80
SHA512 36ec3d504c0bdf4d63106797199376e5e6e4db7a5916516010b856f27e81d746f5e1dd66960c85961c0eb2599ad5f63a65006d31cdc768a42faf42d5398fef56
SSDEEP 3072:Z1NjcVVnLpPu8FCQWVvhtHZx2BdTeh9R4mdouzw16ysYrlMRZrwN2FB3k91HE2H7:jNeZWJhe4hEvl60I/3SLHqLw
TLSH
T19844F601A7F8865AF9F75B30ADBA96965A77BC912E35C19F2300BBAD0C71700D924733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1620	Un_A.exe

Executes dropped EXE 1 IoCs

pid	Process
1620	Un_A.exe

Loads dropped DLL 9 IoCs

pid	Process
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe
1620	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Un_A.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Un_A.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_8ca954726c774692a26087cc0e858117_cloudeye_elex_loki-bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_A.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	Un_A.exe
1620	Un_A.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 1620	5420	2026-09-25_8ca954726c774692a26087cc0e858117_cloudeye_elex_loki-bot.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-25_8ca954726c774692a26087cc0e858117_cloudeye_elex_loki-bot.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_8ca954726c774692a26087cc0e858117_cloudeye_elex_loki-bot.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\FindProcDLL.dll
Size 3KB
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
TLSH
T1E07186BA56E54FFDD1541A3030CE7003EBDE75B416AB625AC93B261A7BD0191D83CA22
MD5 SHA1 SHA512 TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\INetC.dll
Size 24KB
SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
MD5 640bff73a5f8e37b202d911e4749b2e9
SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
TLSH
T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisFirewall.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6151.tmp\nsisFirewall.dll
Size 8KB
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
TLSH
T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un_A.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 258KB
SHA256 5068dc04d6350419acdf812588ae28a1cd95c3cad4d7102b3f4b9650abd19a5b
MD5 8ca954726c774692a26087cc0e858117
SHA1 631a188ed8827453b8b773f68ce6789e4f3f9e80
SHA512 36ec3d504c0bdf4d63106797199376e5e6e4db7a5916516010b856f27e81d746f5e1dd66960c85961c0eb2599ad5f63a65006d31cdc768a42faf42d5398fef56
SSDEEP 3072:Z1NjcVVnLpPu8FCQWVvhtHZx2BdTeh9R4mdouzw16ysYrlMRZrwN2FB3k91HE2H7:jNeZWJhe4hEvl60I/3SLHqLw
TLSH
T19844F601A7F8865AF9F75B30ADBA96965A77BC912E35C19F2300BBAD0C71700D924733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads