Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
c1929c01d6adbb6635757097ff5d95d6.exe
Resource
win7-20240220-en
General
-
Target
c1929c01d6adbb6635757097ff5d95d6.exe
-
Size
974KB
-
MD5
c1929c01d6adbb6635757097ff5d95d6
-
SHA1
830557cd37d07a4b7a9a500fe0f1f5099d436e43
-
SHA256
fe11921cd872f4c76fa3d9698da1aeba5470bb58e6b64e7537d29b4a8980cf3c
-
SHA512
dfee7060eacacb8da3a3fac4e2b39995af27ca6a30d9ef609739346461d527db3a327f38446cb750e145a5348cc1b5855911576f31e3c1fbc4bff04d5e0ffbc2
-
SSDEEP
12288:83RFUa2iNwY05uYGrFDsugLcwLVvVfSkVylG5B7/I070JQ:na1W5uYGrFj+x5EsylwBR70JQ
Malware Config
Extracted
lokibot
http://185.227.139.5/sxisodifntose.php/S7zr5v1fXI3Rb
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions c1929c01d6adbb6635757097ff5d95d6.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools c1929c01d6adbb6635757097ff5d95d6.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c1929c01d6adbb6635757097ff5d95d6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c1929c01d6adbb6635757097ff5d95d6.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation c1929c01d6adbb6635757097ff5d95d6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c1929c01d6adbb6635757097ff5d95d6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2584 powershell.exe 2312 c1929c01d6adbb6635757097ff5d95d6.exe 2312 c1929c01d6adbb6635757097ff5d95d6.exe 2584 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1240 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 2312 c1929c01d6adbb6635757097ff5d95d6.exe Token: SeDebugPrivilege 1240 c1929c01d6adbb6635757097ff5d95d6.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2584 2312 c1929c01d6adbb6635757097ff5d95d6.exe 102 PID 2312 wrote to memory of 2584 2312 c1929c01d6adbb6635757097ff5d95d6.exe 102 PID 2312 wrote to memory of 2584 2312 c1929c01d6adbb6635757097ff5d95d6.exe 102 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 PID 2312 wrote to memory of 1240 2312 c1929c01d6adbb6635757097ff5d95d6.exe 104 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook c1929c01d6adbb6635757097ff5d95d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"C:\Users\Admin\AppData\Local\Temp\c1929c01d6adbb6635757097ff5d95d6.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-566096764-1992588923-1249862864-1000\0f5007522459c86e95ffcc62f32308f1_2935d258-24ea-4115-bc36-d204b07adb8d
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-566096764-1992588923-1249862864-1000\0f5007522459c86e95ffcc62f32308f1_2935d258-24ea-4115-bc36-d204b07adb8d
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b