Overview

overview

10

Static

static

b31fdfb032...1a.exe

windows7_x64

10

b31fdfb032...1a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20/01/2022, 15:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b31fdfb032644bcb1f8b072f4dc5e11a.exe
  • Size 197KB
  • Sample220120-s23d9aaed8
  • SHA256 4ef528f41c74b287a3bc8bcb4cf1cde16d54b0fbdffe11e845e5aa2b656dc961
  • MD5 SHA1 SHA512
Score
10/10
guloaderlokibotponycollectiondiscoverydownloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • lokibot

C2

  • http://windowssecuritycheck.gdn/gx/l/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Extracted

Family

  • pony

C2

  • http://windowssecuritycheck.gdn/gx/p/gate.php

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks QEMU agent file 2 TTPs 4 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b31fdfb032644bcb1f8b072f4dc5e11a.exe
    "C:\Users\Admin\AppData\Local\Temp\b31fdfb032644bcb1f8b072f4dc5e11a.exe"
    1⤵
    • Checks QEMU agent file
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Users\Admin\AppData\Local\Temp\b31fdfb032644bcb1f8b072f4dc5e11a.exe
      "C:\Users\Admin\AppData\Local\Temp\b31fdfb032644bcb1f8b072f4dc5e11a.exe"
      2⤵
      • Checks QEMU agent file
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\DRAMATIS.com
        "C:\Users\Admin\AppData\Local\Temp\DRAMATIS.com"
        3⤵
        • Executes dropped EXE
        • Checks QEMU agent file
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Users\Admin\AppData\Local\Temp\DRAMATIS.com
          "C:\Users\Admin\AppData\Local\Temp\DRAMATIS.com"
          4⤵
          • Checks QEMU agent file
          • Checks computer location settings
          • Loads dropped DLL
          • Accesses Microsoft Outlook accounts
          • Accesses Microsoft Outlook profiles
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_win_path
          PID:4084
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30387312.bat" "C:\Users\Admin\AppData\Local\Temp\DRAMATIS.com" "
            5⤵
              PID:2156
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe b0075bd3a92b4e50b3e8b82d04575384 m1LUVBdGck63P0D30X+vRQ.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:1228

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1900-137-0x0000000001660000-0x00000000017F0000-memory.dmp
          Download

          memory/1900-139-0x0000000077000000-0x00000000771A3000-memory.dmp
          Download

          memory/1900-136-0x0000000000400000-0x0000000001654000-memory.dmp
          Download

          memory/1900-145-0x0000000000400000-0x0000000001654000-memory.dmp
          Download

          memory/1900-138-0x00007FFCE5970000-0x00007FFCE5B65000-memory.dmp
          Download

          memory/2452-133-0x00007FFCE5970000-0x00007FFCE5B65000-memory.dmp
          Download

          memory/2452-132-0x00000000021E0000-0x0000000002208000-memory.dmp
          Download

          memory/2452-135-0x0000000077000000-0x00000000771A3000-memory.dmp
          Download

          memory/2452-134-0x0000000077000000-0x00000000771A3000-memory.dmp
          Download

          memory/2792-146-0x00000000020A0000-0x00000000020C8000-memory.dmp
          Download

          memory/2792-150-0x0000000077000000-0x00000000771A3000-memory.dmp
          Download

          memory/2792-148-0x00007FFCE5970000-0x00007FFCE5B65000-memory.dmp
          Download

          memory/4084-151-0x0000000001660000-0x00000000017E0000-memory.dmp
          Download

          memory/4084-152-0x00007FFCE5970000-0x00007FFCE5B65000-memory.dmp
          Download

          memory/4084-153-0x0000000077000000-0x00000000771A3000-memory.dmp
          Download

          memory/4084-154-0x0000000000400000-0x0000000001654000-memory.dmp
          Download