Analysis
-
max time kernel
97s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44.exe
-
Size
181KB
-
MD5
d3d4f9479544722b50d57432447b57b0
-
SHA1
61c78287030f58e9e3840e2415cae8e99dce4a2e
-
SHA256
673e868cb19ea890ef69957e11d08b95d761957623c36a5e3396804e7685bb44
-
SHA512
84ed67440e7d2c73014db09376dcb0e7db13583752054bfb8a50ae84d896d34ed5b1a7cac4d6aa6989fdf86714435fac49c1145338c2c33cc9ea6793256e3d64
-
SSDEEP
3072:nCmlA+2TGMF85+bkRG32foUP9GmPe97UodZDO4eHsZZZZZZZZZZZZZtRP/tUlnfR:CmlV4h8JG3QUzdZDO4eHsZZZZZZZZZZ
Malware Config
Extracted
Family
koiloader
C2
http://89.251.22.227/guacos.php
Attributes
-
payload_url
https://lechiavetteusb.it/imgs/usb/logo
Signatures
-
Detects KoiLoader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-1-0x00000000010F0000-0x00000000010FD000-memory.dmp family_koi_loader -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-1-0x00000000010F0000-0x00000000010FD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4572-1-0x00000000010F0000-0x00000000010FD000-memory.dmpFilesize
52KB