Analysis
- max time kernel
154s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
23/02/2022, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
d26b79f2653547f7d7b4a5580a47d969.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d26b79f2653547f7d7b4a5580a47d969.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target d26b79f2653547f7d7b4a5580a47d969.exe
- Size 294KB
- Sample220223-ql86raaca8
- SHA256 6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281
- MD5 d26b79f2653547f7d7b4a5580a47d969
- SHA1 6e82af7ed6970fca7e1be62cf653742d072f1fba
- SHA512 f1d9c59cbeec45eb2fd5c97e45c970467f89d0754d96d49debd6b2f1957e834d696c99e1efda73321899d868c0b861703c9bdd19711e28f278059bea1fa7762a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://164.90.194.235/?id=22044231991792986
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d26b79f2653547f7d7b4a5580a47d969.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 2172 d26b79f2653547f7d7b4a5580a47d969.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation d26b79f2653547f7d7b4a5580a47d969.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook d26b79f2653547f7d7b4a5580a47d969.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d26b79f2653547f7d7b4a5580a47d969.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook d26b79f2653547f7d7b4a5580a47d969.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~3.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MIA062~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI391D~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13153~1.55\MICROS~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe d26b79f2653547f7d7b4a5580a47d969.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE d26b79f2653547f7d7b4a5580a47d969.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com d26b79f2653547f7d7b4a5580a47d969.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" d26b79f2653547f7d7b4a5580a47d969.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2172 d26b79f2653547f7d7b4a5580a47d969.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3080 wrote to memory of 2172 3080 d26b79f2653547f7d7b4a5580a47d969.exe 60 PID 3080 wrote to memory of 2172 3080 d26b79f2653547f7d7b4a5580a47d969.exe 60 PID 3080 wrote to memory of 2172 3080 d26b79f2653547f7d7b4a5580a47d969.exe 60 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook d26b79f2653547f7d7b4a5580a47d969.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook d26b79f2653547f7d7b4a5580a47d969.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d26b79f2653547f7d7b4a5580a47d969.exe"C:\Users\Admin\AppData\Local\Temp\d26b79f2653547f7d7b4a5580a47d969.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\d26b79f2653547f7d7b4a5580a47d969.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\d26b79f2653547f7d7b4a5580a47d969.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2172
-