Analysis
- max time kernel
4294178s - max time network
120s - platform
windows7_x64 - resource
win7-20220223-en - submitted
04/03/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
9aaaa429c55d07a5611231f46a6f5b4e.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9aaaa429c55d07a5611231f46a6f5b4e.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 9aaaa429c55d07a5611231f46a6f5b4e.exe
- Size 269KB
- Sample220304-h2n7hsdhe2
- SHA256 1e36f8b1165ea81970aff36a7b13fe4bdd02f4bf95b08f634ea446d0668de24f
- MD5 9aaaa429c55d07a5611231f46a6f5b4e
- SHA1 cf5a08e34b01a37447d2eb33b8ed5140500c7213
- SHA512 5c77cd2237dcb304e39e1265988869698c24c8e96d58eb2d73160bd0629f926d485d757412ad72ce68b08692fadacadd369cdabf16f80a6a8381add8ff99f860
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://164.90.194.235/?id=22044231991792986
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9aaaa429c55d07a5611231f46a6f5b4e.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 788 9aaaa429c55d07a5611231f46a6f5b4e.exe - Loads dropped DLL 3 IoCs
pid Process 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 9aaaa429c55d07a5611231f46a6f5b4e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9aaaa429c55d07a5611231f46a6f5b4e.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 788 9aaaa429c55d07a5611231f46a6f5b4e.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 788 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 27 PID 1720 wrote to memory of 788 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 27 PID 1720 wrote to memory of 788 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 27 PID 1720 wrote to memory of 788 1720 9aaaa429c55d07a5611231f46a6f5b4e.exe 27 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaaa429c55d07a5611231f46a6f5b4e.exe"C:\Users\Admin\AppData\Local\Temp\9aaaa429c55d07a5611231f46a6f5b4e.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9aaaa429c55d07a5611231f46a6f5b4e.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9aaaa429c55d07a5611231f46a6f5b4e.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:788
-