Analysis
- max time kernel
155s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
16/02/2022, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
330a8fb4247200c44c45df3014dedd5f.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 330a8fb4247200c44c45df3014dedd5f.exe
- Size 756KB
- Sample220216-1kcfhaeehr
- SHA256 20d53efcba3ab0f64d0f2cb3561e81ef6b306413bd015954e1fb11014e97a1f5
- MD5 330a8fb4247200c44c45df3014dedd5f
- SHA1 d66c96b0d269eaa168b5b14a74acf55c7e94b82e
- SHA512 dcb82c1be373632eb93c41d0b1b7bdda8a12d1617806b9ee602849aa184f833d0768ab50667fa2158ee3c90867296f4e7ba4a2185329713497dd0aad6b771dfc
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://lauzon-ent.com/createdme/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 330a8fb4247200c44c45df3014dedd5f.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 330a8fb4247200c44c45df3014dedd5f.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 330a8fb4247200c44c45df3014dedd5f.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2588 set thread context of 3280 2588 330a8fb4247200c44c45df3014dedd5f.exe 77 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 52 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "19.990405" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3988" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.932536" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.012917" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4272" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.040000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896977609247968" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4136" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4280" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2588 330a8fb4247200c44c45df3014dedd5f.exe 2588 330a8fb4247200c44c45df3014dedd5f.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2588 330a8fb4247200c44c45df3014dedd5f.exe 2588 330a8fb4247200c44c45df3014dedd5f.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3280 330a8fb4247200c44c45df3014dedd5f.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe Token: SeRestorePrivilege 2108 TiWorker.exe Token: SeSecurityPrivilege 2108 TiWorker.exe Token: SeBackupPrivilege 2108 TiWorker.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3280 2588 330a8fb4247200c44c45df3014dedd5f.exe 77 PID 2588 wrote to memory of 3280 2588 330a8fb4247200c44c45df3014dedd5f.exe 77 PID 2588 wrote to memory of 3280 2588 330a8fb4247200c44c45df3014dedd5f.exe 77 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 330a8fb4247200c44c45df3014dedd5f.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 330a8fb4247200c44c45df3014dedd5f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\330a8fb4247200c44c45df3014dedd5f.exe"C:\Users\Admin\AppData\Local\Temp\330a8fb4247200c44c45df3014dedd5f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\330a8fb4247200c44c45df3014dedd5f.exe"C:\Users\Admin\AppData\Local\Temp\330a8fb4247200c44c45df3014dedd5f.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- outlook_office_path
- outlook_win_path
PID:3280
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1428
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2480
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2440
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2108