Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
04/03/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
2ee042fe81d0760c89c80fbb19ddd1fa.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2ee042fe81d0760c89c80fbb19ddd1fa.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 2ee042fe81d0760c89c80fbb19ddd1fa.exe
- Size 269KB
- Sample220304-h2n7hsfebn
- SHA256 6fcd9b779accb07c3b05ac111df68e64fbc255f81887a60d810b94acd6f44388
- MD5 2ee042fe81d0760c89c80fbb19ddd1fa
- SHA1 125ac2f854404fdb3133e128d484bc3bffe95dc4
- SHA512 458b362da0116bf37713ddb6a792c9d350e137485bf051e3b69461ec19f37a9b877417c5d8705b433fa1394190f4b2e7fb7ac48e36ff6381fbcf6173e8c651af
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://164.90.194.235/?id=17007285853618101
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
- Executes dropped EXE 1 IoCs
pid Process 2812 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2ee042fe81d0760c89c80fbb19ddd1fa.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 2ee042fe81d0760c89c80fbb19ddd1fa.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{A9F77~1\EDGEMI~1.TMP\setup.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\BHO\IE_TO_~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\IDENTI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13153~1.55\MICROS~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~2.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI391D~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\msedge.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~4.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MICROS~3.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13153~1.55\MI9C33~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\MSEDGE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\NOTIFI~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\PWAHEL~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\COOKIE~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 2ee042fe81d0760c89c80fbb19ddd1fa.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\970107~1.55\ELEVAT~1.EXE 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2812 2ee042fe81d0760c89c80fbb19ddd1fa.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4336 wrote to memory of 2812 4336 2ee042fe81d0760c89c80fbb19ddd1fa.exe 81 PID 4336 wrote to memory of 2812 4336 2ee042fe81d0760c89c80fbb19ddd1fa.exe 81 PID 4336 wrote to memory of 2812 4336 2ee042fe81d0760c89c80fbb19ddd1fa.exe 81 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 2ee042fe81d0760c89c80fbb19ddd1fa.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 2ee042fe81d0760c89c80fbb19ddd1fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ee042fe81d0760c89c80fbb19ddd1fa.exe"C:\Users\Admin\AppData\Local\Temp\2ee042fe81d0760c89c80fbb19ddd1fa.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2ee042fe81d0760c89c80fbb19ddd1fa.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2ee042fe81d0760c89c80fbb19ddd1fa.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2812
-