Analysis
- max time kernel
143s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
04/03/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
9aaaa429c55d07a5611231f46a6f5b4e.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9aaaa429c55d07a5611231f46a6f5b4e.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 9aaaa429c55d07a5611231f46a6f5b4e.exe
- Size 269KB
- Sample220304-h2n7hsdhe2
- SHA256 1e36f8b1165ea81970aff36a7b13fe4bdd02f4bf95b08f634ea446d0668de24f
- MD5 9aaaa429c55d07a5611231f46a6f5b4e
- SHA1 cf5a08e34b01a37447d2eb33b8ed5140500c7213
- SHA512 5c77cd2237dcb304e39e1265988869698c24c8e96d58eb2d73160bd0629f926d485d757412ad72ce68b08692fadacadd369cdabf16f80a6a8381add8ff99f860
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://164.90.194.235/?id=22044231991792986
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9aaaa429c55d07a5611231f46a6f5b4e.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 3688 9aaaa429c55d07a5611231f46a6f5b4e.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 9aaaa429c55d07a5611231f46a6f5b4e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\NOTIFI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{A9F77~1\EDGEMI~1.TMP\setup.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\BHO\IE_TO_~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI391D~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\COOKIE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~3.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~2.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\ELEVAT~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13153~1.55\MICROS~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\IDENTI~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 9aaaa429c55d07a5611231f46a6f5b4e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 9aaaa429c55d07a5611231f46a6f5b4e.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 9aaaa429c55d07a5611231f46a6f5b4e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9aaaa429c55d07a5611231f46a6f5b4e.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3688 9aaaa429c55d07a5611231f46a6f5b4e.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3688 4720 9aaaa429c55d07a5611231f46a6f5b4e.exe 79 PID 4720 wrote to memory of 3688 4720 9aaaa429c55d07a5611231f46a6f5b4e.exe 79 PID 4720 wrote to memory of 3688 4720 9aaaa429c55d07a5611231f46a6f5b4e.exe 79 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9aaaa429c55d07a5611231f46a6f5b4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaaa429c55d07a5611231f46a6f5b4e.exe"C:\Users\Admin\AppData\Local\Temp\9aaaa429c55d07a5611231f46a6f5b4e.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9aaaa429c55d07a5611231f46a6f5b4e.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9aaaa429c55d07a5611231f46a6f5b4e.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3688
-