Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44.exe
-
Size
181KB
-
MD5
d3d4f9479544722b50d57432447b57b0
-
SHA1
61c78287030f58e9e3840e2415cae8e99dce4a2e
-
SHA256
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44
-
SHA512
84ed67440e7d2c73014db09376dcb0e7db13583752054bfb8a50ae84d896d34ed5b1a7cac4d6aa6989fdf86714435fac49c1145338c2c33cc9ea6793256e3d64
-
SSDEEP
3072:nCmlA+2TGMF85+bkRG32foUP9GmPe97UodZDO4eHsZZZZZZZZZZZZZtRP/tUlnfR:CmlV4h8JG3QUzdZDO4eHsZZZZZZZZZZ
Malware Config
Extracted
Family
koiloader
C2
http://89.251.22.227/guacos.php
Attributes
-
payload_url
https://lechiavetteusb.it/imgs/usb/logo
Signatures
-
Detects KoiLoader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1672-0-0x0000000000130000-0x000000000013D000-memory.dmp family_koi_loader -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1672-0-0x0000000000130000-0x000000000013D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1672-0-0x0000000000130000-0x000000000013D000-memory.dmpFilesize
52KB