lokibot | a07c65637bff22e30c394682fdadacbdfc252d8a48abf2ac69f7e5d21cec6c40

General

Target

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
Size

213KB
MD5

cb5a734b40ca605caf417cf725a73d7e
SHA1

1f64186091fba7390338001ed37a8bd7b4778f08
SHA256

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd
SHA512

e5af26105a62cbb761621547376fc96143bf6d6762dff805e62b8c30c7ee1e01d55177c3ca42592d92a058dc89e0e56f58061d29f42757026bb05434363719fe
SSDEEP

3072:WwJ52Y7ZoH5XJaVFJwayPiMuPmfmqflNd7oF3/BSlPLL4sO9Jpgj+UzkpnujbP4i:WwHysLJwrbBvlNCwPLL1O9GkpuntZ3

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://ipvhosted.duckdns.org:6060/hosted/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Loads dropped DLL 2 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

pid	process
4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	pid	process	target process
PID 4944 set thread context of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe
1096	AcroRd32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

pid process

1828 ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description pid process

Token: SeDebugPrivilege 1828 ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1096 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

1096 AcroRd32.exe
1096 AcroRd32.exe
1096 AcroRd32.exe
1096 AcroRd32.exe
1096 AcroRd32.exe
1096 AcroRd32.exe

pid	process
1828	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	pid	process
Token: SeDebugPrivilege	1828	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exeAcroRd32.exeab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exeRdrCEF.exe

description	pid	process	target process
PID 3020 wrote to memory of 1096	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	AcroRd32.exe
PID 3020 wrote to memory of 1096	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	AcroRd32.exe
PID 3020 wrote to memory of 1096	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	AcroRd32.exe
PID 3020 wrote to memory of 4944	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 3020 wrote to memory of 4944	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 3020 wrote to memory of 4944	3020	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 1096 wrote to memory of 1820	1096	AcroRd32.exe	RdrCEF.exe
PID 1096 wrote to memory of 1820	1096	AcroRd32.exe	RdrCEF.exe
PID 1096 wrote to memory of 1820	1096	AcroRd32.exe	RdrCEF.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 4944 wrote to memory of 1828	4944	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 4924	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 3824	1820	RdrCEF.exe	RdrCEF.exe
PID 1820 wrote to memory of 3824	1820	RdrCEF.exe	RdrCEF.exe

outlook_office_path 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

outlook_win_path 1 IoCs

Processes:

ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe

C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
"C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\PDF-BIND.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4CEA3585BA7190843B3B2E8FF6552E4B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4CEA3585BA7190843B3B2E8FF6552E4B --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
4⤵
PID:4924

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=39D976D34EE93D74EE2AC3D69E36BD40 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3824

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2A773FFD5911FC21E18B57C333E70971 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2A773FFD5911FC21E18B57C333E70971 --renderer-client-id=4 --mojo-platform-channel-handle=2148 --allow-no-sandbox-job /prefetch:1
4⤵
PID:3740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FC9AF07AA76B6839734520FEF668A7F1 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:1120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9C3F3C633E5DFA822DDF8720FD81E880 --mojo-platform-channel-handle=2684 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:1056

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F4C50E73054452DF40CE12BD2496AF25 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
C:\Users\Admin\AppData\Local\Temp\ab7f2cace5639d856b4f95f3b96776b2f62de75b7d4c48fabcfccf63b90a2cbd.exe
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl15FA.tmp\System.dll
Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\opepe.dll
Filesize
31KB

MD5
dc9c2ca936513eedd6be1ba0228a12b7

SHA1
42f8757690ff223b9090f3fede0c6925a36397c8

SHA256
e7d5716f4143144d8c7d1724efb8f71bd8551de46dd34f789479ed9cbbe941fc

SHA512
bf9396dce500d9719cff457752a6275a780bd4e51382a49726ba10fd5ebf4870b0b2bccb7a343bba20ae17149ffafb79192727546b8b0fded8a8430128827c6c

Download Submit
C:\Users\Admin\AppData\Roaming\PDF-BIND.pdf
Filesize
11KB

MD5
7e8658e8ab332deabb412e9e5e18d3c7

SHA1
15dec2ecfff716f64640547037bab97abe76babf

SHA256
c3da54e92d1849a438ee030fd47fdefb79b32e04ca0e254728444db1cfc4ee93

SHA512
87d789c5d8cc266a34c1cd122edc3aa02fc798d0dcb7567686f61498e35f975dc438cfd94f1f4e125b854249339cfaf7e056ce6e6fbe9030baca2575b30ab7ae

Download Submit
memory/1056-162-0x0000000000000000-mapping.dmp

Download
memory/1096-132-0x0000000000000000-mapping.dmp

Download
memory/1120-158-0x0000000000000000-mapping.dmp

Download
memory/1820-137-0x0000000000000000-mapping.dmp

Download
memory/1828-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1828-139-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1828-142-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1828-138-0x0000000000000000-mapping.dmp

Download
memory/1828-160-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2928-165-0x0000000000000000-mapping.dmp

Download
memory/3740-153-0x0000000000000000-mapping.dmp

Download
memory/3824-148-0x0000000000000000-mapping.dmp

Download
memory/4436-146-0x0000000000000000-mapping.dmp

Download
memory/4924-144-0x0000000000000000-mapping.dmp

Download
memory/4944-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads