Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2024, 23:31

General

  • Target

    RefTechnical Drawing Sheet.exe

  • Size

    953KB

  • MD5

    971bdb03f3caf8bb34464d3629c6fd5a

  • SHA1

    2c28ace22924960730814e5a787ffcadde187278

  • SHA256

    4abdae9b05fb343406136ff0cf863e8f403dc294578f111a746b125d59c5c91b

  • SHA512

    6e160db5481a91b18bfee7ecdd7a1a18150072f5c518b351c6ffa36f2b176ee46318e61c42b58e00278dc926446e5b040aa85e42ab610faf9bd8822d7bc4bcd2

  • SSDEEP

    24576:lbZCmf67FtuZFX3KJQgI/tpWrZAOWaTUF3w:N3f67FtuZB3oQNpWDWawF3w

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RefTechnical Drawing Sheet.exe
    "C:\Users\Admin\AppData\Local\Temp\RefTechnical Drawing Sheet.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Designeringen=Get-Content 'C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.San';$Indiciets=$Designeringen.SubString(58339,3);.$Indiciets($Designeringen)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:4292
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:4896
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3340

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vmgs42ez.qkc.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.San

        Filesize

        57KB

        MD5

        0c865acf7c347c6dd359f98c8251a9bc

        SHA1

        dc6ad24450f7a966e5c090abce2ec06f23cef9ae

        SHA256

        00f3155ff5edff6c7b7286095854eae05446345e358018fee4c5fb141a458d7e

        SHA512

        a7ead01800f440b0d4e8f07040818ed72ff1c768cb44ffc1823230b5bee96238b25373a652be4509c88cb371772da1061f5b14b3fa5a7e1e7833dc07d56f1aaa

      • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Skibslejlighedernes.Mid

        Filesize

        331KB

        MD5

        2bacc6e73f38a23b51232641499c7f06

        SHA1

        a025b456d210fc55f396701e268fba2f3949905d

        SHA256

        6225888e9e81bb79d091fcb742c75f5e5b38b0bf46836a1dcaeb7eaa680f6cc8

        SHA512

        bf1996b6da8b026315a95fd71d61d4b730a37af1e461d2f8f42a57027aff5e914bfc121d41d00f38ae59e2f02c3bf43ce507f692742b3d84d9c1cce272ca6f79

      • memory/2200-7-0x0000000073530000-0x0000000073CE0000-memory.dmp

        Filesize

        7.7MB

      • memory/2200-8-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-9-0x0000000002970000-0x00000000029A6000-memory.dmp

        Filesize

        216KB

      • memory/2200-10-0x00000000054E0000-0x0000000005B08000-memory.dmp

        Filesize

        6.2MB

      • memory/2200-11-0x0000000005B10000-0x0000000005B32000-memory.dmp

        Filesize

        136KB

      • memory/2200-12-0x0000000005BB0000-0x0000000005C16000-memory.dmp

        Filesize

        408KB

      • memory/2200-13-0x0000000005C90000-0x0000000005CF6000-memory.dmp

        Filesize

        408KB

      • memory/2200-23-0x0000000005D00000-0x0000000006054000-memory.dmp

        Filesize

        3.3MB

      • memory/2200-24-0x00000000062D0000-0x00000000062EE000-memory.dmp

        Filesize

        120KB

      • memory/2200-25-0x0000000006850000-0x000000000689C000-memory.dmp

        Filesize

        304KB

      • memory/2200-26-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-27-0x0000000007280000-0x0000000007316000-memory.dmp

        Filesize

        600KB

      • memory/2200-28-0x00000000067A0000-0x00000000067BA000-memory.dmp

        Filesize

        104KB

      • memory/2200-29-0x00000000067F0000-0x0000000006812000-memory.dmp

        Filesize

        136KB

      • memory/2200-30-0x00000000078D0000-0x0000000007E74000-memory.dmp

        Filesize

        5.6MB

      • memory/2200-32-0x0000000008500000-0x0000000008B7A000-memory.dmp

        Filesize

        6.5MB

      • memory/2200-34-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-36-0x0000000007820000-0x0000000007824000-memory.dmp

        Filesize

        16KB

      • memory/2200-38-0x0000000073530000-0x0000000073CE0000-memory.dmp

        Filesize

        7.7MB

      • memory/2200-39-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-40-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-41-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/2200-42-0x0000000008B80000-0x000000000E63E000-memory.dmp

        Filesize

        90.7MB

      • memory/2200-43-0x0000000076F81000-0x00000000770A1000-memory.dmp

        Filesize

        1.1MB

      • memory/2200-75-0x0000000073530000-0x0000000073CE0000-memory.dmp

        Filesize

        7.7MB

      • memory/4896-44-0x0000000077008000-0x0000000077009000-memory.dmp

        Filesize

        4KB

      • memory/4896-45-0x0000000076F81000-0x00000000770A1000-memory.dmp

        Filesize

        1.1MB

      • memory/4896-60-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-59-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-61-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-62-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-63-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-64-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-65-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-67-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-66-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-69-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-68-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-70-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-71-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-72-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-73-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-74-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-76-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-77-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-79-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-81-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-80-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-83-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-84-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-86-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-88-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-90-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-92-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-94-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-97-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-96-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-95-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-93-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-91-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-89-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-87-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-85-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-82-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-78-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4896-58-0x0000000001000000-0x0000000006ABE000-memory.dmp

        Filesize

        90.7MB