Overview

overview

10

Static

static

4cea5d8cb3...0a.msi

windows7_x64

10

4cea5d8cb3...0a.msi

windows10_x64

10

Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    19-10-2021 10:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4cea5d8cb3e0a17e942812e31667120a.msi

  • Size

    124KB

  • MD5

    4cea5d8cb3e0a17e942812e31667120a

  • SHA1

    c526373cc21495053cdf3ff735f10e4f031659b7

  • SHA256

    be4448eb3e5f348051538b82b3e9b63191da49d028e6c5f2b8de4cbc6135c84a

  • SHA512

    1eed5b3fa630ca2e4998e5eae400cab82a2e65005107f9bae0ae04a7ed7b32373ffaaf486578acca13bf74c38193e62fbb51da381555fec8d45c10a40cc962f7

Score
10/10
guloaderlokibotcollectiondownloaderpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=6446112

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • suricata: ET MALWARE LokiBot Checkin

    suricata: ET MALWARE LokiBot Checkin

    suricata
  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    suricata
  • Executes dropped EXE 1 IoCs
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4cea5d8cb3e0a17e942812e31667120a.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2696
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1116
    • C:\Windows\Installer\MSI6252.tmp
      "C:\Windows\Installer\MSI6252.tmp"
      2⤵
      • Executes dropped EXE
      • Checks QEMU agent file
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\Installer\MSI6252.tmp
        "C:\Windows\Installer\MSI6252.tmp"
        3⤵
        • Checks QEMU agent file
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:808
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2216
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI6252.tmp
    MD5

    9c0f4f8b74d0c49c28997dcc175897c9

    SHA1

    56aedf510fe21edf7f5deb00b210e50f54f44443

    SHA256

    9fd8a479a9f54341cfea3c2906cbc779c8623a288708ac00e21a486f325e3934

    SHA512

    c2ff13b0737904fc97fdd57a17f9d4885776a5c07d1c3a884292e7143df2966397e4f4820a39450c950b2e3c68fdf2799091357fa9f129ef196e962f4c5e8ba3

    Download Submit
  • C:\Windows\Installer\MSI6252.tmp
    MD5

    9c0f4f8b74d0c49c28997dcc175897c9

    SHA1

    56aedf510fe21edf7f5deb00b210e50f54f44443

    SHA256

    9fd8a479a9f54341cfea3c2906cbc779c8623a288708ac00e21a486f325e3934

    SHA512

    c2ff13b0737904fc97fdd57a17f9d4885776a5c07d1c3a884292e7143df2966397e4f4820a39450c950b2e3c68fdf2799091357fa9f129ef196e962f4c5e8ba3

    Download Submit
  • C:\Windows\Installer\MSI6252.tmp
    MD5

    9c0f4f8b74d0c49c28997dcc175897c9

    SHA1

    56aedf510fe21edf7f5deb00b210e50f54f44443

    SHA256

    9fd8a479a9f54341cfea3c2906cbc779c8623a288708ac00e21a486f325e3934

    SHA512

    c2ff13b0737904fc97fdd57a17f9d4885776a5c07d1c3a884292e7143df2966397e4f4820a39450c950b2e3c68fdf2799091357fa9f129ef196e962f4c5e8ba3

    Download Submit
  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    MD5

    63213015f97efaed80ce4b59c5a6d84e

    SHA1

    084b99b9baf8ec4b6c74d8767868ec8b322a5fc5

    SHA256

    566fae0e4b702c6f995b4d8d9c80aab67f5d028c07d6292a32275ef9b2013d6e

    SHA512

    09626335afe94954d5da1d147db0f9b849b10124f96d2ca6a373f6c407a2b0d53ed4f280d9175bbe11e57d3b81c07166e26aef36b8bd497a80175f95763f30f1

    Download Submit
  • \??\Volume{0e38e18f-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{b95b5c96-54fe-4ff5-9fd3-cd64e5159a9d}_OnDiskSnapshotProp
    MD5

    13f00a20cd13c651338a50a791193594

    SHA1

    9dce116380e844a1351a2b6ded387f0818d45d3a

    SHA256

    dea2144e7f752a2a918df082ee0d83c5d37b0409a9cdfb61ac9b3ff3df53451f

    SHA512

    3427b91e7b0c1277b8b279b5d1d1f9d7956fb8b863ff4ae6d0f89614753dde399f67b58ad7e64272e37d8ef5baccd505b997a03bfe1c013f2c5cea27d76f6424

    Download Submit
  • memory/808-134-0x0000000000401000-0x00000000004FD000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/808-139-0x0000000077DD0000-0x0000000077F5E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/808-136-0x0000000000560000-0x0000000000660000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/808-137-0x00007FFE81190000-0x00007FFE8136B000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/808-132-0x0000000000400000-0x0000000000553000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/808-138-0x0000000077DD0000-0x0000000077F5E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/808-130-0x0000000000401230-mapping.dmp
    Download
  • memory/808-140-0x0000000000400000-0x0000000000553000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1116-119-0x0000000000000000-mapping.dmp
    Download
  • memory/1372-124-0x0000000001FF0000-0x0000000001FFA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1372-127-0x0000000077DD0000-0x0000000077F5E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1372-126-0x00007FFE81190000-0x00007FFE8136B000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1372-125-0x0000000002050000-0x0000000002061000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1372-120-0x0000000000000000-mapping.dmp
    Download
  • memory/1372-135-0x0000000077DD0000-0x0000000077F5E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1372-123-0x0000000001FF0000-0x0000000001FF6000-memory.dmp
    Filesize

    24KB

    Download
  • memory/2696-115-0x000001D213A10000-0x000001D213A12000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2696-116-0x000001D213A10000-0x000001D213A12000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3652-118-0x0000023D4A5C0000-0x0000023D4A5C2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3652-117-0x0000023D4A5C0000-0x0000023D4A5C2000-memory.dmp
    Filesize

    8KB

    Download