Analysis

  • max time kernel
    70s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2024, 07:33

General

  • Target

    Ref_Technical Drawing Sheet.exe

  • Size

    963KB

  • MD5

    2f96e6fd36ceec8c32dcc6c7607a87bd

  • SHA1

    89b9bd60c39a582da440112f12f939c90102d567

  • SHA256

    11bfafb62ab5e5c115862409c849f069dc0903abf0f864783bea73472db19932

  • SHA512

    755e29062263821fac7c37be3dd7e0b980804adbe301d1945c9098ca1cb8ae57f293a022a2e11677e404bac323b4e5995d4c57d45c2edb13595ff151547993b9

  • SSDEEP

    12288:wbZfqmfr+7Iz6tuhHr2WX3rLKJQEKKHP9SxG4A1wF7dieRJ14BEtIX2UgGj+Xtah:wbZCmf67FtuZFX3KJQgl4KEoEoePUF3Z

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref_Technical Drawing Sheet.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref_Technical Drawing Sheet.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Trykimprgnerede=Get-Content 'C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Bedwarmer.Hom';$Ekstraparlementarisk=$Trykimprgnerede.SubString(59534,3);.$Ekstraparlementarisk($Trykimprgnerede)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:3276
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
            PID:3916
          • C:\Program Files (x86)\windows mail\wab.exe
            "C:\Program Files (x86)\windows mail\wab.exe"
            3⤵
              PID:4692
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              3⤵
                PID:1008
              • C:\Program Files (x86)\windows mail\wab.exe
                "C:\Program Files (x86)\windows mail\wab.exe"
                3⤵
                  PID:1476
                • C:\Program Files (x86)\windows mail\wab.exe
                  "C:\Program Files (x86)\windows mail\wab.exe"
                  3⤵
                    PID:1628
                  • C:\Program Files (x86)\windows mail\wab.exe
                    "C:\Program Files (x86)\windows mail\wab.exe"
                    3⤵
                      PID:4356
                    • C:\Program Files (x86)\windows mail\wab.exe
                      "C:\Program Files (x86)\windows mail\wab.exe"
                      3⤵
                        PID:860
                      • C:\Program Files (x86)\windows mail\wab.exe
                        "C:\Program Files (x86)\windows mail\wab.exe"
                        3⤵
                          PID:2724
                        • C:\Program Files (x86)\windows mail\wab.exe
                          "C:\Program Files (x86)\windows mail\wab.exe"
                          3⤵
                            PID:1708
                          • C:\Program Files (x86)\windows mail\wab.exe
                            "C:\Program Files (x86)\windows mail\wab.exe"
                            3⤵
                              PID:2168
                            • C:\Program Files (x86)\windows mail\wab.exe
                              "C:\Program Files (x86)\windows mail\wab.exe"
                              3⤵
                                PID:660
                              • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                3⤵
                                  PID:3580
                                • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                  "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                  3⤵
                                    PID:4396
                                  • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                    "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                    3⤵
                                      PID:4680
                                    • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                      "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                      3⤵
                                        PID:4492
                                      • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                        "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                        3⤵
                                          PID:64
                                        • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                          "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                          3⤵
                                            PID:232
                                          • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                            "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                            3⤵
                                              PID:2708
                                            • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                              "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                              3⤵
                                                PID:1824
                                              • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                                "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                                3⤵
                                                  PID:1320
                                                • C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
                                                  "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                                  3⤵
                                                    PID:3276
                                                  • C:\Program Files (x86)\windows mail\wabmig.exe
                                                    "C:\Program Files (x86)\windows mail\wabmig.exe"
                                                    3⤵
                                                      PID:3360
                                                    • C:\Program Files (x86)\windows mail\wabmig.exe
                                                      "C:\Program Files (x86)\windows mail\wabmig.exe"
                                                      3⤵
                                                      • Accesses Microsoft Outlook profiles
                                                      • Suspicious use of NtCreateThreadExHideFromDebugger
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • outlook_office_path
                                                      • outlook_win_path
                                                      PID:2572

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ao24u2ys.xju.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\Bedwarmer.Hom

                                                  Filesize

                                                  58KB

                                                  MD5

                                                  aae5fcb1e66470ef7a08ea335b80ac05

                                                  SHA1

                                                  9422c0898c87a134c72c6ffa35c594d93dba9dc9

                                                  SHA256

                                                  8bd9205c7c8f112ff5cba1307842eddccc18e20e227cccb7b74e6a24e686b8b0

                                                  SHA512

                                                  031d187a47a9b687d6822f34e74029f2f1cf4eb8687dc2846a3d84efbf9d30d5459870842a22cdab89130915501e2593f79b2a32da5c266d382120e0a042b072

                                                • C:\Users\Admin\AppData\Local\butikstiders\Sjunger\sikkerhedskden.Han

                                                  Filesize

                                                  347KB

                                                  MD5

                                                  1178f466a9ac164a3ca05ffd715235dc

                                                  SHA1

                                                  e593a180adbbb864047e9dbc5e07a6d27a252139

                                                  SHA256

                                                  38bea98d1ec5467345cf29e1a7f1ec9a25fbe7801c8a498ec05e97b6dbf9545b

                                                  SHA512

                                                  61269e7303efba0f6d2790b780b9f4348567c6ad48481822201b37e13c17f255d35b368d109ba6c9d9a66d9af1adb7f2db9e3ec6ab1b351f80fce368f23a3650

                                                • memory/2572-81-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-85-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-68-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-83-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-87-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-89-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-92-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-94-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-96-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-98-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-97-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-95-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-93-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-91-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-90-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-88-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-65-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-66-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-86-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-75-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-84-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-82-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-80-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-71-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-79-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-78-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-46-0x00000000777F1000-0x0000000077911000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2572-47-0x0000000077878000-0x0000000077879000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2572-57-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-62-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-63-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-64-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-76-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-67-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-77-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-61-0x0000000000E00000-0x00000000042C3000-memory.dmp

                                                  Filesize

                                                  52.8MB

                                                • memory/2572-69-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-70-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-72-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/2572-74-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                  Filesize

                                                  1.9MB

                                                • memory/3356-35-0x0000000073DA0000-0x0000000074550000-memory.dmp

                                                  Filesize

                                                  7.7MB

                                                • memory/3356-73-0x0000000073DA0000-0x0000000074550000-memory.dmp

                                                  Filesize

                                                  7.7MB

                                                • memory/3356-36-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-11-0x0000000005710000-0x0000000005D38000-memory.dmp

                                                  Filesize

                                                  6.2MB

                                                • memory/3356-45-0x00000000777F1000-0x0000000077911000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3356-44-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-43-0x0000000008EC0000-0x000000000C383000-memory.dmp

                                                  Filesize

                                                  52.8MB

                                                • memory/3356-42-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-7-0x0000000002D50000-0x0000000002D86000-memory.dmp

                                                  Filesize

                                                  216KB

                                                • memory/3356-41-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-39-0x0000000007990000-0x0000000007994000-memory.dmp

                                                  Filesize

                                                  16KB

                                                • memory/3356-38-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-8-0x0000000073DA0000-0x0000000074550000-memory.dmp

                                                  Filesize

                                                  7.7MB

                                                • memory/3356-33-0x0000000008840000-0x0000000008EBA000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                • memory/3356-9-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-31-0x0000000007C10000-0x00000000081B4000-memory.dmp

                                                  Filesize

                                                  5.6MB

                                                • memory/3356-29-0x0000000006910000-0x000000000692A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/3356-30-0x0000000006960000-0x0000000006982000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/3356-28-0x00000000075C0000-0x0000000007656000-memory.dmp

                                                  Filesize

                                                  600KB

                                                • memory/3356-27-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-26-0x0000000006490000-0x00000000064DC000-memory.dmp

                                                  Filesize

                                                  304KB

                                                • memory/3356-25-0x00000000063F0000-0x000000000640E000-memory.dmp

                                                  Filesize

                                                  120KB

                                                • memory/3356-21-0x0000000005DB0000-0x0000000006104000-memory.dmp

                                                  Filesize

                                                  3.3MB

                                                • memory/3356-10-0x00000000050D0000-0x00000000050E0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/3356-16-0x0000000005D40000-0x0000000005DA6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                • memory/3356-13-0x0000000005660000-0x00000000056C6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                • memory/3356-12-0x0000000005490000-0x00000000054B2000-memory.dmp

                                                  Filesize

                                                  136KB