analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

decoded_ps1

Full analysis: https://app.any.run/tasks/bd507295-64b2-4dea-ab52-d2b29e3f0f05
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: November 20, 2018, 12:20:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
opendir
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

72C0AAAC257F6DE8BDB9F2CBDD05E47B

SHA1:

D76A8A78352357398BFF570663C326C84B969686

SHA256:

B926D9A9231C4A1E7E031A6A7CA4DF8018F6DCDBBDB956D7E3DA3B45BE20650C

SSDEEP:

12288:gG6x3u0OkeDq/H/HPZtL88YwQVj1z7qDFxEUj8XdrhscrdbSL:g3lLIyH/HH8TwQVZz7qDbjK2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WTKOd.exe (PID: 3872)
      • WTKOd.exe (PID: 3712)

    • Changes the autorun value in the registry

      • WTKOd.exe (PID: 3712)

    • LOKIBOT was detected

      • WTKOd.exe (PID: 3872)

    • Detected artifacts of LokiBot

      • WTKOd.exe (PID: 3872)

    • Connects to CnC server

      • WTKOd.exe (PID: 3872)

    • Actions looks like stealing of personal data

      • WTKOd.exe (PID: 3872)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 4080)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 3876)
      • powershell.exe (PID: 800)
      • WTKOd.exe (PID: 3872)

    • Uses RUNDLL32.EXE to load library

      • powershell.exe (PID: 4080)

    • Application launched itself

      • powershell.exe (PID: 4080)
      • WTKOd.exe (PID: 3712)

    • Executes PowerShell scripts

      • powershell.exe (PID: 4080)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3568)
      • WTKOd.exe (PID: 3712)
      • WTKOd.exe (PID: 3872)

    • Loads DLL from Mozilla Firefox

      • WTKOd.exe (PID: 3872)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start rundll32.exe no specs explorer.exe no specs powershell.exe rundll32.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe wtkod.exe #LOKIBOT wtkod.exe

Process information

PID
CMD
Path
Indicators
Parent process
2996"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\decoded_ps1C:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3236"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4080"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3221225786
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3684"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\decoded_ps1C:\Windows\system32\rundll32.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
800"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -file .\decoded_ps1C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
4294770688
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3876"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -file .\decoded_ps1C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
4294770688
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3568"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -file .\decoded_ps1.ps1C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3712"C:\Users\admin\AppData\Roaming\WTKOd.exe" C:\Users\admin\AppData\Roaming\WTKOd.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3872"C:\Users\admin\AppData\Roaming\WTKOd.exe" C:\Users\admin\AppData\Roaming\WTKOd.exe
WTKOd.exe
User:
admin
Integrity Level:
HIGH
Total events
2 373
Read events
1 969
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
8
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
4080powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RBR65024KMK3AHZD0WOB.temp —
MD5:—
SHA256:—
800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U1BYLTNHA8YGJCLAC2V0.temp —
MD5:—
SHA256:—
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RL26FRGA9YTIN7OX8X8R.temp —
MD5:—
SHA256:—
3568powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IKEQFDDLYC89PWAJ81P5.temp —
MD5:—
SHA256:—
3872WTKOd.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
4080powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:381ADB3CA1D8749FB0832A613C3227E0
SHA256:C0D23168A081A8EC088C157E5DBF526CC0037CE9D401870851A74EAF9C29BA99
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
4080powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF25d230.TMPbinary
MD5:381ADB3CA1D8749FB0832A613C3227E0
SHA256:C0D23168A081A8EC088C157E5DBF526CC0037CE9D401870851A74EAF9C29BA99
800powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
3568powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF26fad2.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3872
WTKOd.exe
POST
—
142.44.213.212:80
http://apolovapers.com/app/images/five/fre.php
CA
—
—
malicious
3872
WTKOd.exe
POST
—
142.44.213.212:80
http://apolovapers.com/app/images/five/fre.php
CA
—
—
malicious
3872
WTKOd.exe
POST
—
142.44.213.212:80
http://apolovapers.com/app/images/five/fre.php
CA
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3872
WTKOd.exe
142.44.213.212:80
apolovapers.com
OVH SAS
CA
malicious

DNS requests

Domain
IP
Reputation
apolovapers.com
  • 142.44.213.212
malicious

Threats

PID
Process
Class
Message
3872
WTKOd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki/Pony Bot Artifact Check-in
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3872
WTKOd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3872
WTKOd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki/Pony Bot Artifact Check-in
3872
WTKOd.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
decoded_ps1