Overview

overview

10

Static

static

3

b6cd42853c...82.exe

windows7-x64

10

b6cd42853c...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6cd42853c9f137da206ed6dfd50f8b2d1e02c11279893410ff410a9bd505682.exe

  • Size

    181KB

  • MD5

    d00c83d7c1ab5910961439e14bb3032f

  • SHA1

    8c10f3727dc912a985181eaf8cf7b6e585c040bb

  • SHA256

    b6cd42853c9f137da206ed6dfd50f8b2d1e02c11279893410ff410a9bd505682

  • SHA512

    bd73b838fdc31f4cc1906a6c62f8c1d4fab80226810c9c9fcb46ba13f93cac6b6035e9a0432ce22be8fae5421bc7b61b638c16bd8627c687427c0e48e14a2413

  • SSDEEP

    3072:nCmlA+2TGMF85+bkRG32foUP9GmPe97UoY6SvZxMkVF79j1xZrU2CsOcQ2nj/NZ:CmlV4h8JG3QUzbScbSJQ2j/NZ

Score
10/10
koiloaderloader

Malware Config

Extracted

Family

koiloader

C2

http://81.19.141.115/marasmus.php

Attributes
  • payload_url

    https://www.dsestimation.com/wp-content/uploads/2015/10

Signatures

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader
  • Detects KoiLoader payload 1 IoCs
    loader
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6cd42853c9f137da206ed6dfd50f8b2d1e02c11279893410ff410a9bd505682.exe
    "C:\Users\Admin\AppData\Local\Temp\b6cd42853c9f137da206ed6dfd50f8b2d1e02c11279893410ff410a9bd505682.exe"
    1⤵
      PID:2340

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2340-0-0x00000000000F0000-0x00000000000FD000-memory.dmp
      Filesize

      52KB

      Download