Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
c1929c01d6adbb6635757097ff5d95d6.exe
Resource
win7-20240220-en
General
-
Target
c1929c01d6adbb6635757097ff5d95d6.exe
-
Size
974KB
-
MD5
c1929c01d6adbb6635757097ff5d95d6
-
SHA1
830557cd37d07a4b7a9a500fe0f1f5099d436e43
-
SHA256
fe11921cd872f4c76fa3d9698da1aeba5470bb58e6b64e7537d29b4a8980cf3c
-
SHA512
dfee7060eacacb8da3a3fac4e2b39995af27ca6a30d9ef609739346461d527db3a327f38446cb750e145a5348cc1b5855911576f31e3c1fbc4bff04d5e0ffbc2
-
SSDEEP
12288:83RFUa2iNwY05uYGrFDsugLcwLVvVfSkVylG5B7/I070JQ:na1W5uYGrFj+x5EsylwBR70JQ
Malware Config
Extracted
lokibot
http://185.227.139.5/sxisodifntose.php/S7zr5v1fXI3Rb
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions c1929c01d6adbb6635757097ff5d95d6.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools c1929c01d6adbb6635757097ff5d95d6.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c1929c01d6adbb6635757097ff5d95d6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c1929c01d6adbb6635757097ff5d95d6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c1929c01d6adbb6635757097ff5d95d6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1740 c1929c01d6adbb6635757097ff5d95d6.exe 2440 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2820 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1740 c1929c01d6adbb6635757097ff5d95d6.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 2820 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2440 1740 c1929c01d6adbb6635757097ff5d95d6.exe 28 PID 1740 wrote to memory of 2440 1740 c1929c01d6adbb6635757097ff5d95d6.exe 28 PID 1740 wrote to memory of 2440 1740 c1929c01d6adbb6635757097ff5d95d6.exe 28 PID 1740 wrote to memory of 2440 1740 c1929c01d6adbb6635757097ff5d95d6.exe 28 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 PID 1740 wrote to memory of 2820 1740 c1929c01d6adbb6635757097ff5d95d6.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991c
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b