Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/05/2024, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
432e0c7502686e9481f9ca6789ad7abd.msi
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
432e0c7502686e9481f9ca6789ad7abd.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 432e0c7502686e9481f9ca6789ad7abd.msi
- Size 336KB
- Sample240516-ctvrfagc2w
- SHA256 41a4b1a20caa14c769accdc803196fcc6f70968ebe9f8acd867321f7cc46962e
- MD5 432e0c7502686e9481f9ca6789ad7abd
- SHA1 e762906f2796322d856f0b38bbe2a189324e7329
- SHA512 f994dc800a0c45738b6b1e8fe3f4f547abd9229e43717420125c292434d2abb7829936de10ad4393842a26c01fb887971d08121394a3d0326fbe13646681fac8
- SSDEEP 6144:jEUCChbFhINvtvbO0yhNPh/UCkYxKLpdDKIqtlxq5q+9xpZu:jEEYfKZhNPJU9YORKlU5qO
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
lokibot
C2
-
http://deloilte.com/wp-admin/user/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSI850F.tmp Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSI850F.tmp Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSI850F.tmp - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1000 set thread context of 1664 1000 MSI850F.tmp 105 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI850F.tmp msiexec.exe File created C:\Windows\Installer\e5783c6.msi msiexec.exe File opened for modification C:\Windows\Installer\e5783c6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI84B1.tmp msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 1000 MSI850F.tmp 1664 MSI850F.tmp - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 996 msiexec.exe 996 msiexec.exe - Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 1556 msiexec.exe Token: SeIncreaseQuotaPrivilege 1556 msiexec.exe Token: SeSecurityPrivilege 996 msiexec.exe Token: SeCreateTokenPrivilege 1556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1556 msiexec.exe Token: SeLockMemoryPrivilege 1556 msiexec.exe Token: SeIncreaseQuotaPrivilege 1556 msiexec.exe Token: SeMachineAccountPrivilege 1556 msiexec.exe Token: SeTcbPrivilege 1556 msiexec.exe Token: SeSecurityPrivilege 1556 msiexec.exe Token: SeTakeOwnershipPrivilege 1556 msiexec.exe Token: SeLoadDriverPrivilege 1556 msiexec.exe Token: SeSystemProfilePrivilege 1556 msiexec.exe Token: SeSystemtimePrivilege 1556 msiexec.exe Token: SeProfSingleProcessPrivilege 1556 msiexec.exe Token: SeIncBasePriorityPrivilege 1556 msiexec.exe Token: SeCreatePagefilePrivilege 1556 msiexec.exe Token: SeCreatePermanentPrivilege 1556 msiexec.exe Token: SeBackupPrivilege 1556 msiexec.exe Token: SeRestorePrivilege 1556 msiexec.exe Token: SeShutdownPrivilege 1556 msiexec.exe Token: SeDebugPrivilege 1556 msiexec.exe Token: SeAuditPrivilege 1556 msiexec.exe Token: SeSystemEnvironmentPrivilege 1556 msiexec.exe Token: SeChangeNotifyPrivilege 1556 msiexec.exe Token: SeRemoteShutdownPrivilege 1556 msiexec.exe Token: SeUndockPrivilege 1556 msiexec.exe Token: SeSyncAgentPrivilege 1556 msiexec.exe Token: SeEnableDelegationPrivilege 1556 msiexec.exe Token: SeManageVolumePrivilege 1556 msiexec.exe Token: SeImpersonatePrivilege 1556 msiexec.exe Token: SeCreateGlobalPrivilege 1556 msiexec.exe Token: SeBackupPrivilege 4084 vssvc.exe Token: SeRestorePrivilege 4084 vssvc.exe Token: SeAuditPrivilege 4084 vssvc.exe Token: SeBackupPrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeBackupPrivilege 1412 srtasks.exe Token: SeRestorePrivilege 1412 srtasks.exe Token: SeSecurityPrivilege 1412 srtasks.exe Token: SeTakeOwnershipPrivilege 1412 srtasks.exe Token: SeBackupPrivilege 1412 srtasks.exe Token: SeRestorePrivilege 1412 srtasks.exe Token: SeSecurityPrivilege 1412 srtasks.exe Token: SeTakeOwnershipPrivilege 1412 srtasks.exe Token: SeDebugPrivilege 1000 MSI850F.tmp Token: SeRestorePrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeRestorePrivilege 996 msiexec.exe Token: SeTakeOwnershipPrivilege 996 msiexec.exe Token: SeDebugPrivilege 1664 MSI850F.tmp - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1556 msiexec.exe 1556 msiexec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 996 wrote to memory of 1412 996 msiexec.exe 100 PID 996 wrote to memory of 1412 996 msiexec.exe 100 PID 996 wrote to memory of 1000 996 msiexec.exe 102 PID 996 wrote to memory of 1000 996 msiexec.exe 102 PID 996 wrote to memory of 1000 996 msiexec.exe 102 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 PID 1000 wrote to memory of 1664 1000 MSI850F.tmp 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSI850F.tmp - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSI850F.tmp
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\432e0c7502686e9481f9ca6789ad7abd.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Windows\Installer\MSI850F.tmp"C:\Windows\Installer\MSI850F.tmp"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\Installer\MSI850F.tmp"C:\Windows\Installer\MSI850F.tmp"3⤵
- Accesses Microsoft Outlook profiles
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1664
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5783c9.rbs
- Size 649B
- SHA256 7076ca4f8b78f21a80b3bbb1175fbb6238985482a16b8decc40436806f1ccf9e
- MD5 64bc72dfedc420a5f70995aff21af8aa
- SHA1 c300c1002082d45ad8a2a7aa206a7089b1f13669
- SHA512 1f2151bc658ed366634ba8f8b65e1bfcebbd03e54e50f1d60b4d7ba91d8ddbe4385ba3239600312ccdcaf43e7c3c5cff4ffb7fa85c10e555c4b4a08376fbb114
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
- Size 46B
- SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
- MD5 c07225d4e7d01d31042965f048728a0a
- SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
- SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
- Size 46B
- SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
- MD5 d898504a722bff1524134c6ab6a5eaa5
- SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
- SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI850F.tmp
- Size 311KB
- SHA256 66fa5aa2b0ba33ed6f2c733308fac9af3589ebe85849c7c130ab8365f0a708b6
- MD5 da9877633c4e09c16d3593021f84e011
- SHA1 d2883239114cf8e0fa235cdb854065070ff60ad5
- SHA512 21adf2ec80f3d0f2dc034ca40637c1a3ea391f552e3a3048a97a1d68c73c49f3548ab02b6e51ebb6ce987533221e6ae17ecbb9522bdcdbc7b58870b8eef7b07a
- SSDEEP 6144:dCChbFhINvtvbO0yhNPh/UCkYxKLpdDKIqtlxq5q+9xpZu:hYfKZhNPJU9YORKlU5qO
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 20be649ccdd4652d9ab7c1e57935f323ef99af14030eb5d4d0b1975e15755120
- MD5 b40476587e8d1b1b014a6c7662af35a3
- SHA1 5b8a17c955146d31e9f5c5e77a503d0f44d018c9
- SHA512 0a5bb5e40d3d31a28d90bdf40802e6ed39909ed76db1bcf0a70c41f08f8e34a879b41470d47759cca68ee47e6b12c4db11dc961206a498fbe1defa563c263e7c
- SSDEEP 24576:LSqm41xkdoO/vvTLE3HugnWXkEI51A6ajjHd58wWaWq7WU72oRFoL63CA:e
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e55d0fad-a623-4307-a082-ea5193775f5e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 cbd06391ba9428cf24e88155485815a21881c857ca6b9f99d85cff97b77359f6
- MD5 c9e7d1ebdf0ad52a0f5a4ad3a017ce9f
- SHA1 4f8170c3af58aba5ecca0011f6e33ad683e3bb72
- SHA512 d46e4b9ad27696f3eb11a08edfd49694808290c8b51c0bd3eae794cfcbc2a53e190fb3615d821363093f87afa8371a8ed0d1afb49d8820e87d4b2661cfae176a
- SSDEEP 96:FK/tRsc4HsDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Onb++1Vm
- MD5 SHA1 SHA512 SSDEEP