Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
04/03/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
7a174472497dc70f725a3c99974f38be.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7a174472497dc70f725a3c99974f38be.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 7a174472497dc70f725a3c99974f38be.exe
- Size 367KB
- Sample220304-h2n7hsdhd9
- SHA256 ba66dd24d4e15ad89e20c99cc4fc7dbbdd429299e0edd1a36be467d98334a30a
- MD5 7a174472497dc70f725a3c99974f38be
- SHA1 806f39d3b8d5a5e8b1d7a3f6fa28954170d108b4
- SHA512 51829af4c29e5045f158aafcac8ace366dcb6896dea42e2d4de3bf10a4352033ea4f498dca90b7c58cc83e851089cd6fb8e1f27baa97aba44fc0ea923c319c64
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://164.90.194.235/?id=17007285853618101
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7a174472497dc70f725a3c99974f38be.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 760 7a174472497dc70f725a3c99974f38be.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 7a174472497dc70f725a3c99974f38be.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7a174472497dc70f725a3c99974f38be.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 7a174472497dc70f725a3c99974f38be.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 7a174472497dc70f725a3c99974f38be.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MIA062~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13153~1.55\MICROS~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI391D~1.EXE 7a174472497dc70f725a3c99974f38be.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~3.EXE 7a174472497dc70f725a3c99974f38be.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 7a174472497dc70f725a3c99974f38be.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 7a174472497dc70f725a3c99974f38be.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 760 7a174472497dc70f725a3c99974f38be.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3092 wrote to memory of 760 3092 7a174472497dc70f725a3c99974f38be.exe 57 PID 3092 wrote to memory of 760 3092 7a174472497dc70f725a3c99974f38be.exe 57 PID 3092 wrote to memory of 760 3092 7a174472497dc70f725a3c99974f38be.exe 57 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 7a174472497dc70f725a3c99974f38be.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 7a174472497dc70f725a3c99974f38be.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a174472497dc70f725a3c99974f38be.exe"C:\Users\Admin\AppData\Local\Temp\7a174472497dc70f725a3c99974f38be.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\7a174472497dc70f725a3c99974f38be.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7a174472497dc70f725a3c99974f38be.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:760
-