Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 16:26
Static task
static1
Behavioral task
behavioral1
Sample
0553ae7af8a6276b7ac154eb1ab1018f.exe
Resource
win7-20220901-en
General
-
Target
0553ae7af8a6276b7ac154eb1ab1018f.exe
-
Size
876KB
-
MD5
0553ae7af8a6276b7ac154eb1ab1018f
-
SHA1
250f9c2c7fcf3b3737bf76ec572a499437807ef2
-
SHA256
929326cdad02e238d239eb6aa0d162fe2bb1f0e67538807f89f58d927cd25526
-
SHA512
ed00c0dc681d294593b8d3bfc4bff17a449003dbc383e4a82d5c1542f4a99e9ac9ea91892c66ec6f37aa45852e4b9466125496fa5c457b56b808bd2323640014
-
SSDEEP
12288:DWiAPoeMlfqU6mNxosq22XUZVAFVwmpXx1ZOrQ7K4HTN:qi5eMAU6d22XUWVwmphm
Malware Config
Extracted
lokibot
http://162.0.223.13/?lerwUQjXGkaqpcVaFYobv5p64auikJJGYacS1wQHQ07fd3qT2P5xUuEZF9hZS1GQcTJepAVfA3vO7WI9MNHHilGXuYWnZDd
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0553ae7af8a6276b7ac154eb1ab1018f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 0553ae7af8a6276b7ac154eb1ab1018f.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 0553ae7af8a6276b7ac154eb1ab1018f.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0553ae7af8a6276b7ac154eb1ab1018f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription pid process target process PID 3928 set thread context of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
NTFS ADS 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\alrpc:[protected_storage] 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 5096 powershell.exe 2920 powershell.exe 5096 powershell.exe 2920 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exepid process 4492 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exe0553ae7af8a6276b7ac154eb1ab1018f.exedescription pid process Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 2920 powershell.exe Token: SeDebugPrivilege 4492 0553ae7af8a6276b7ac154eb1ab1018f.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription pid process target process PID 3928 wrote to memory of 5096 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 5096 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 5096 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 2920 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 2920 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 2920 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe powershell.exe PID 3928 wrote to memory of 4276 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe schtasks.exe PID 3928 wrote to memory of 4276 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe schtasks.exe PID 3928 wrote to memory of 4276 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe schtasks.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe PID 3928 wrote to memory of 4492 3928 0553ae7af8a6276b7ac154eb1ab1018f.exe 0553ae7af8a6276b7ac154eb1ab1018f.exe -
outlook_office_path 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 0553ae7af8a6276b7ac154eb1ab1018f.exe -
outlook_win_path 1 IoCs
Processes:
0553ae7af8a6276b7ac154eb1ab1018f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0553ae7af8a6276b7ac154eb1ab1018f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0553ae7af8a6276b7ac154eb1ab1018f.exe"C:\Users\Admin\AppData\Local\Temp\0553ae7af8a6276b7ac154eb1ab1018f.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0553ae7af8a6276b7ac154eb1ab1018f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oShQppxjcwzFsk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oShQppxjcwzFsk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3066.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\0553ae7af8a6276b7ac154eb1ab1018f.exe"C:\Users\Admin\AppData\Local\Temp\0553ae7af8a6276b7ac154eb1ab1018f.exe"2⤵
- Accesses Microsoft Outlook profiles
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD56f7c369d2bc89d6deac1986d0bf5c849
SHA11c89b16e1a4fa755d4c2f96a9b0d699998fbd459
SHA256a7ac41a815f9b1a35e5edcd3ca3b5d97dcfab98e94a4a0d83337dd2fcc3b4d63
SHA5123b5f343332047033076f2a8368f026e9581713cc5709053e731c84310652231df9b0963a0c8cee5bb5e58adb1cb013136bb7501be153bce091bf06a3f84cc384
-
C:\Users\Admin\AppData\Local\Temp\tmp3066.tmpFilesize
1KB
MD5a6e97774f245f87159f9db5f4ebe12b2
SHA1d37fb997cf570ba798b1d05a15e52951191e44d6
SHA256d3b251200c510af521289ae859b8308f2782339306f2c9d5961e63e633c4900d
SHA51230910a8d55645a9b211b033746016c3d106fbfcdd36ab1823cd75833b135b4716536de39009eb0c1c9d5dcc9ab2422bc0d315673020399e131c3d11c9dfb5949
-
memory/2920-158-0x0000000006EF0000-0x0000000006EFA000-memory.dmpFilesize
40KB
-
memory/2920-162-0x00000000071A0000-0x00000000071A8000-memory.dmpFilesize
32KB
-
memory/2920-140-0x0000000000000000-mapping.dmp
-
memory/2920-160-0x00000000070B0000-0x00000000070BE000-memory.dmpFilesize
56KB
-
memory/2920-156-0x0000000006E80000-0x0000000006E9A000-memory.dmpFilesize
104KB
-
memory/2920-153-0x000000006FEE0000-0x000000006FF2C000-memory.dmpFilesize
304KB
-
memory/3928-136-0x0000000007B30000-0x0000000007BCC000-memory.dmpFilesize
624KB
-
memory/3928-137-0x0000000007BD0000-0x0000000007C36000-memory.dmpFilesize
408KB
-
memory/3928-135-0x0000000004A90000-0x0000000004A9A000-memory.dmpFilesize
40KB
-
memory/3928-134-0x0000000004B00000-0x0000000004B92000-memory.dmpFilesize
584KB
-
memory/3928-132-0x0000000000020000-0x00000000000FE000-memory.dmpFilesize
888KB
-
memory/3928-133-0x00000000050B0000-0x0000000005654000-memory.dmpFilesize
5.6MB
-
memory/4276-142-0x0000000000000000-mapping.dmp
-
memory/4492-149-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4492-146-0x0000000000000000-mapping.dmp
-
memory/4492-151-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4492-165-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4492-147-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/5096-144-0x00000000058E0000-0x0000000005946000-memory.dmpFilesize
408KB
-
memory/5096-155-0x0000000007650000-0x000000000766E000-memory.dmpFilesize
120KB
-
memory/5096-157-0x0000000008030000-0x00000000086AA000-memory.dmpFilesize
6.5MB
-
memory/5096-154-0x000000006FEE0000-0x000000006FF2C000-memory.dmpFilesize
304KB
-
memory/5096-150-0x00000000066E0000-0x00000000066FE000-memory.dmpFilesize
120KB
-
memory/5096-159-0x0000000007C60000-0x0000000007CF6000-memory.dmpFilesize
600KB
-
memory/5096-143-0x0000000005740000-0x0000000005762000-memory.dmpFilesize
136KB
-
memory/5096-161-0x0000000007D20000-0x0000000007D3A000-memory.dmpFilesize
104KB
-
memory/5096-141-0x0000000005B20000-0x0000000006148000-memory.dmpFilesize
6.2MB
-
memory/5096-139-0x0000000002DE0000-0x0000000002E16000-memory.dmpFilesize
216KB
-
memory/5096-138-0x0000000000000000-mapping.dmp
-
memory/5096-152-0x0000000007670000-0x00000000076A2000-memory.dmpFilesize
200KB