Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-07-2023 19:55

General

  • Target

    Final_Test.exe

  • Size

    530KB

  • MD5

    ce6ba3df1d57ade7830c5315d77c9311

  • SHA1

    251e75ac4468d26f76eaa9fe6458e169d3757dd4

  • SHA256

    ce8bbc09521bc9bd7a358e4fbbe370962e22b91a78c8d895716ef98a1daaaf77

  • SHA512

    b35cd30bd0ed8a4faab706ec0ec0c5c2494764f5a4a8f6cf416341f868a257e54f8d0ecbfd6523f3fc42fc914dd487a5cc14d86f433a8c5ae8775e131f4c50e6

  • SSDEEP

    12288:0/dqneaMkgoWOtT1oslIRJUfLKvxMiFS9/j+esTCmuPcB:0/dqe1PoZt5HMgLo2micB

Malware Config

Extracted

Family

lokibot

C2

http://meta-mim.in/wp-includes/js/pzy/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

netwire

C2

iheuche009.hopto.org:1199

Attributes
  • activex_autorun

    true

  • activex_key

    {84B0DIYX-PC63-6D34-570T-YW54Q1M2RH7A}

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    IRobWUAG

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    true

  • startup_name

    Avast

  • use_mutex

    true

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Final_Test.exe
    "C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Users\Admin\AppData\Local\Temp\Final_Test.exe
      "C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Users\Admin\AppData\Local\Temp\build.exe
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2184
      • C:\Users\Admin\AppData\Local\Temp\Host.exe
        "C:\Users\Admin\AppData\Local\Temp\Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          4⤵
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          PID:3316
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    PID:5112

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Host.exe

    Filesize

    132KB

    MD5

    881779ca64253b8849df903a23e6d652

    SHA1

    f564352d587ebea5527de51b7bd1269a47355973

    SHA256

    863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d

    SHA512

    2aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94

  • C:\Users\Admin\AppData\Local\Temp\Host.exe

    Filesize

    132KB

    MD5

    881779ca64253b8849df903a23e6d652

    SHA1

    f564352d587ebea5527de51b7bd1269a47355973

    SHA256

    863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d

    SHA512

    2aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94

  • C:\Users\Admin\AppData\Local\Temp\Host.exe

    Filesize

    132KB

    MD5

    881779ca64253b8849df903a23e6d652

    SHA1

    f564352d587ebea5527de51b7bd1269a47355973

    SHA256

    863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d

    SHA512

    2aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94

  • C:\Users\Admin\AppData\Local\Temp\build.exe

    Filesize

    104KB

    MD5

    2ef5474132e3e48b54855c7629fdce2e

    SHA1

    4687a86f96c2a48bbe92ca089ee0543ed4c1e5a4

    SHA256

    264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6

    SHA512

    dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba

  • C:\Users\Admin\AppData\Local\Temp\build.exe

    Filesize

    104KB

    MD5

    2ef5474132e3e48b54855c7629fdce2e

    SHA1

    4687a86f96c2a48bbe92ca089ee0543ed4c1e5a4

    SHA256

    264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6

    SHA512

    dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba

  • C:\Users\Admin\AppData\Local\Temp\build.exe

    Filesize

    104KB

    MD5

    2ef5474132e3e48b54855c7629fdce2e

    SHA1

    4687a86f96c2a48bbe92ca089ee0543ed4c1e5a4

    SHA256

    264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6

    SHA512

    dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    132KB

    MD5

    881779ca64253b8849df903a23e6d652

    SHA1

    f564352d587ebea5527de51b7bd1269a47355973

    SHA256

    863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d

    SHA512

    2aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    132KB

    MD5

    881779ca64253b8849df903a23e6d652

    SHA1

    f564352d587ebea5527de51b7bd1269a47355973

    SHA256

    863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d

    SHA512

    2aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3259792829-1422303781-2047321929-1000\0f5007522459c86e95ffcc62f32308f1_7a0b5f63-92b5-4443-b457-34250c67f41d

    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

  • memory/3264-179-0x0000000000400000-0x000000000041AE89-memory.dmp

    Filesize

    107KB

  • memory/3264-178-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3264-155-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3264-162-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3264-161-0x0000000000400000-0x000000000041AE89-memory.dmp

    Filesize

    107KB

  • memory/3264-157-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3316-203-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3856-184-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4844-143-0x0000000002510000-0x0000000002512000-memory.dmp

    Filesize

    8KB

  • memory/4844-145-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/4844-152-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/4844-153-0x00000000022E0000-0x0000000002322000-memory.dmp

    Filesize

    264KB

  • memory/4844-150-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/4844-149-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/4844-160-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/4844-148-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/4844-147-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/4844-146-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/4844-137-0x0000000002360000-0x0000000002361000-memory.dmp

    Filesize

    4KB

  • memory/4844-151-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/4844-144-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/4844-133-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/4844-142-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/4844-141-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB

  • memory/4844-140-0x0000000000810000-0x0000000000811000-memory.dmp

    Filesize

    4KB

  • memory/4844-139-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB

  • memory/4844-138-0x0000000002350000-0x0000000002351000-memory.dmp

    Filesize

    4KB

  • memory/4844-136-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/4844-135-0x0000000002390000-0x0000000002391000-memory.dmp

    Filesize

    4KB

  • memory/4844-134-0x00000000022E0000-0x0000000002322000-memory.dmp

    Filesize

    264KB