Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2024, 23:33

General

  • Target

    RefTechnical Drawing Sheet.exe

  • Size

    953KB

  • MD5

    971bdb03f3caf8bb34464d3629c6fd5a

  • SHA1

    2c28ace22924960730814e5a787ffcadde187278

  • SHA256

    4abdae9b05fb343406136ff0cf863e8f403dc294578f111a746b125d59c5c91b

  • SHA512

    6e160db5481a91b18bfee7ecdd7a1a18150072f5c518b351c6ffa36f2b176ee46318e61c42b58e00278dc926446e5b040aa85e42ab610faf9bd8822d7bc4bcd2

  • SSDEEP

    24576:lbZCmf67FtuZFX3KJQgI/tpWrZAOWaTUF3w:N3f67FtuZB3oQNpWDWawF3w

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RefTechnical Drawing Sheet.exe
    "C:\Users\Admin\AppData\Local\Temp\RefTechnical Drawing Sheet.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Designeringen=Get-Content 'C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.San';$Indiciets=$Designeringen.SubString(58339,3);.$Indiciets($Designeringen)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:4340
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
            PID:1516
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Program Files (x86)\windows mail\wab.exe"
            3⤵
              PID:4648
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              3⤵
                PID:3132
              • C:\Program Files (x86)\windows mail\wab.exe
                "C:\Program Files (x86)\windows mail\wab.exe"
                3⤵
                  PID:2016
                • C:\Program Files (x86)\windows mail\wab.exe
                  "C:\Program Files (x86)\windows mail\wab.exe"
                  3⤵
                    PID:3408
                  • C:\Program Files (x86)\windows mail\wab.exe
                    "C:\Program Files (x86)\windows mail\wab.exe"
                    3⤵
                      PID:3800
                    • C:\Program Files (x86)\windows mail\wab.exe
                      "C:\Program Files (x86)\windows mail\wab.exe"
                      3⤵
                        PID:3496
                      • C:\Program Files (x86)\windows mail\wab.exe
                        "C:\Program Files (x86)\windows mail\wab.exe"
                        3⤵
                          PID:4908
                        • C:\Program Files (x86)\windows mail\wab.exe
                          "C:\Program Files (x86)\windows mail\wab.exe"
                          3⤵
                            PID:3600
                          • C:\Program Files (x86)\windows mail\wab.exe
                            "C:\Program Files (x86)\windows mail\wab.exe"
                            3⤵
                              PID:1124
                            • C:\Program Files (x86)\windows mail\wab.exe
                              "C:\Program Files (x86)\windows mail\wab.exe"
                              3⤵
                                PID:1224
                              • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                3⤵
                                • Accesses Microsoft Outlook profiles
                                • Suspicious use of NtCreateThreadExHideFromDebugger
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of AdjustPrivilegeToken
                                • outlook_office_path
                                • outlook_win_path
                                PID:928
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:4860

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4tadelc.v4p.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Fdrelandskrligehed\Tenuto\Sauria\Handelsbalancerne122.San

                              Filesize

                              57KB

                              MD5

                              0c865acf7c347c6dd359f98c8251a9bc

                              SHA1

                              dc6ad24450f7a966e5c090abce2ec06f23cef9ae

                              SHA256

                              00f3155ff5edff6c7b7286095854eae05446345e358018fee4c5fb141a458d7e

                              SHA512

                              a7ead01800f440b0d4e8f07040818ed72ff1c768cb44ffc1823230b5bee96238b25373a652be4509c88cb371772da1061f5b14b3fa5a7e1e7833dc07d56f1aaa

                            • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Skibslejlighedernes.Mid

                              Filesize

                              331KB

                              MD5

                              2bacc6e73f38a23b51232641499c7f06

                              SHA1

                              a025b456d210fc55f396701e268fba2f3949905d

                              SHA256

                              6225888e9e81bb79d091fcb742c75f5e5b38b0bf46836a1dcaeb7eaa680f6cc8

                              SHA512

                              bf1996b6da8b026315a95fd71d61d4b730a37af1e461d2f8f42a57027aff5e914bfc121d41d00f38ae59e2f02c3bf43ce507f692742b3d84d9c1cce272ca6f79

                            • memory/928-82-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-79-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-65-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-88-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-90-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-91-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-95-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-97-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-96-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-94-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-93-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-92-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-89-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-87-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-86-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-85-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-84-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-83-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-80-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-71-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-78-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-77-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-60-0x0000000001260000-0x0000000006D1E000-memory.dmp

                              Filesize

                              90.7MB

                            • memory/928-76-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-75-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-66-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-46-0x00000000772E8000-0x00000000772E9000-memory.dmp

                              Filesize

                              4KB

                            • memory/928-47-0x0000000077261000-0x0000000077381000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/928-61-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-62-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-63-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-64-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-73-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-67-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-74-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-69-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-68-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-70-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/928-72-0x0000000000400000-0x00000000005E4000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/2156-8-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-12-0x0000000005550000-0x0000000005572000-memory.dmp

                              Filesize

                              136KB

                            • memory/2156-45-0x0000000077261000-0x0000000077381000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/2156-44-0x0000000008F00000-0x000000000E9BE000-memory.dmp

                              Filesize

                              90.7MB

                            • memory/2156-43-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-42-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-41-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-40-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-38-0x0000000073810000-0x0000000073FC0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2156-81-0x0000000073810000-0x0000000073FC0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2156-7-0x0000000073810000-0x0000000073FC0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/2156-37-0x0000000007BA0000-0x0000000007BA4000-memory.dmp

                              Filesize

                              16KB

                            • memory/2156-11-0x0000000005740000-0x0000000005D68000-memory.dmp

                              Filesize

                              6.2MB

                            • memory/2156-35-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-33-0x0000000008880000-0x0000000008EFA000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/2156-9-0x0000000005070000-0x00000000050A6000-memory.dmp

                              Filesize

                              216KB

                            • memory/2156-31-0x0000000007C50000-0x00000000081F4000-memory.dmp

                              Filesize

                              5.6MB

                            • memory/2156-29-0x0000000006B90000-0x0000000006BAA000-memory.dmp

                              Filesize

                              104KB

                            • memory/2156-30-0x0000000006BB0000-0x0000000006BD2000-memory.dmp

                              Filesize

                              136KB

                            • memory/2156-28-0x0000000007600000-0x0000000007696000-memory.dmp

                              Filesize

                              600KB

                            • memory/2156-27-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-26-0x00000000066B0000-0x00000000066FC000-memory.dmp

                              Filesize

                              304KB

                            • memory/2156-25-0x00000000053B0000-0x00000000053CE000-memory.dmp

                              Filesize

                              120KB

                            • memory/2156-24-0x0000000006070000-0x00000000063C4000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/2156-10-0x0000000005100000-0x0000000005110000-memory.dmp

                              Filesize

                              64KB

                            • memory/2156-14-0x0000000006000000-0x0000000006066000-memory.dmp

                              Filesize

                              408KB

                            • memory/2156-13-0x0000000005F20000-0x0000000005F86000-memory.dmp

                              Filesize

                              408KB