Analysis Overview
SHA256
7cc872c2db97ac517a53904af50ad37dd08ca934fd1a48d4ebbd4c593c9cf528
Threat Level: Known bad
The file Payment_Advice.pdf.exe was found to be: Known bad.
Malicious Activity Summary
Lokibot
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-29 13:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-29 13:18
Reported
2024-03-29 13:21
Platform
win7-20240221-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Lokibot
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3028 set thread context of 2580 | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FGZscboXVnu.exe"
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FGZscboXVnu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D89.tmp"
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
Network
Files
memory/3028-0-0x00000000011F0000-0x000000000127C000-memory.dmp
memory/3028-1-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp
memory/3028-2-0x00000000006B0000-0x0000000000730000-memory.dmp
memory/3028-3-0x0000000000580000-0x000000000059A000-memory.dmp
memory/3028-4-0x00000000006A0000-0x00000000006B2000-memory.dmp
memory/3028-5-0x0000000000730000-0x0000000000740000-memory.dmp
memory/3028-6-0x0000000001110000-0x0000000001170000-memory.dmp
memory/3028-7-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp
memory/2656-16-0x000000001B900000-0x000000001BBE2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp7D89.tmp
| MD5 | 11a1224b9a220a54379791702cbdd227 |
| SHA1 | 5f50fd0352935df48df519cd9a531be3d428cf85 |
| SHA256 | 9713e156c860e1a50bb8a54448157ce0285e35fc8f52493c992e2f3e7bdd996e |
| SHA512 | 666a7a5d3f5b679b9d89b030c9851172d9445a8292cc8eaefb0f572cf08eb6509fa82a17c945adc331a2617cecc9a8b23f680cc99307f199db4f8be8909f3853 |
memory/2656-22-0x0000000001F80000-0x0000000001F88000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9K5OPEZA4IT9A2BUUIK3.temp
| MD5 | 27dd825e6196f42c6a40c42711715e4a |
| SHA1 | ba4e45e65dac8c4fb13dee3eb15a0df6867b9476 |
| SHA256 | c066c9c9e74d8384e55950c08651634c468e1d56eeb7d8cd74693a55a18b97a6 |
| SHA512 | 4fe52beb84cecc22b794e1b9d3ec1b55b29516241e201e0cf98a80cf9ed4ee48a1ac3532c5a278e84f1a52c3a8fc997a9a8d1526bc9cb124f30b8c81c7078604 |
memory/3028-24-0x00000000027A0000-0x0000000002842000-memory.dmp
memory/2580-25-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp
memory/3028-30-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp
memory/2112-34-0x000007FEED940000-0x000007FEEE2DD000-memory.dmp
memory/2112-36-0x000007FEED940000-0x000007FEEE2DD000-memory.dmp
memory/2112-35-0x0000000002CB0000-0x0000000002D30000-memory.dmp
memory/2656-33-0x0000000002A2B000-0x0000000002A92000-memory.dmp
memory/2656-32-0x0000000002A24000-0x0000000002A27000-memory.dmp
memory/2656-31-0x000007FEED940000-0x000007FEEE2DD000-memory.dmp
memory/2656-29-0x0000000002A20000-0x0000000002AA0000-memory.dmp
memory/2656-28-0x000007FEED940000-0x000007FEEE2DD000-memory.dmp
memory/2112-38-0x0000000002CB4000-0x0000000002CB7000-memory.dmp
memory/2112-37-0x0000000002CB0000-0x0000000002D30000-memory.dmp
memory/2112-39-0x0000000002CBB000-0x0000000002D22000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-29 13:18
Reported
2024-03-29 13:21
Platform
win10v2004-20240226-en
Max time kernel
147s
Max time network
156s
Command Line
Signatures
Lokibot
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4900 set thread context of 4768 | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FGZscboXVnu.exe"
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FGZscboXVnu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp"
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
C:\Users\Admin\AppData\Local\Temp\Payment_Advice.pdf.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.73.42.20.in-addr.arpa | udp |
Files
memory/4900-0-0x00000000008F0000-0x000000000097C000-memory.dmp
memory/4900-1-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
memory/4900-2-0x0000000001330000-0x0000000001340000-memory.dmp
memory/4900-3-0x0000000001390000-0x00000000013AA000-memory.dmp
memory/4900-4-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
memory/4900-5-0x00000000013D0000-0x00000000013E2000-memory.dmp
memory/4900-6-0x00000000033D0000-0x00000000033E0000-memory.dmp
memory/4900-7-0x000000001D380000-0x000000001D3E0000-memory.dmp
memory/4900-8-0x0000000001330000-0x0000000001340000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp
| MD5 | fed4271685584651c6887279f823e3ec |
| SHA1 | 494040e44812dc2c176bf9328f6acca9203c08a4 |
| SHA256 | ae9d02251f9b57060cd7ae9b2199b3fbf31cde1038549c640e9a35130e60eb6d |
| SHA512 | 84df77e835a568c4c9a4a57414a879b85c20ecacd45990ba6136ca579865bac00ce636d7d1959fa5c2eea319d1d9ec1d5de3c8d47d18b2b00b7ffdf6117125c0 |
memory/2556-14-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
memory/2556-15-0x000001997F4B0000-0x000001997F4C0000-memory.dmp
memory/3772-21-0x0000021873E50000-0x0000021873E72000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1x5twe3.kpn.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3772-37-0x0000021873C90000-0x0000021873CA0000-memory.dmp
memory/2556-40-0x000001997F4B0000-0x000001997F4C0000-memory.dmp
memory/3772-38-0x0000021873C90000-0x0000021873CA0000-memory.dmp
memory/4900-36-0x000000001DE80000-0x000000001DF22000-memory.dmp
memory/3772-35-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
memory/2556-42-0x000001997F4B0000-0x000001997F4C0000-memory.dmp
memory/4900-43-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
memory/3772-44-0x0000021873C90000-0x0000021873CA0000-memory.dmp
memory/2556-45-0x000001997F4B0000-0x000001997F4C0000-memory.dmp
memory/3772-48-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 3a6bad9528f8e23fb5c77fbd81fa28e8 |
| SHA1 | f127317c3bc6407f536c0f0600dcbcf1aabfba36 |
| SHA256 | 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05 |
| SHA512 | 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
memory/2556-52-0x00007FF9C2160000-0x00007FF9C2C21000-memory.dmp