Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 09:11
Static task
static1
Behavioral task
behavioral1
Sample
125hGBgWz4WzJqk.exe
Resource
win7-20240221-en
General
-
Target
125hGBgWz4WzJqk.exe
-
Size
522KB
-
MD5
af7828de16ac18edbe5272bba019623a
-
SHA1
8527db09db74d040a757c458ea4400105c2b1f8d
-
SHA256
43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4
-
SHA512
b92c9f3ea5cae2e334a7b5472575500f7b908df9c596bb357e65341e42374bec83333f237aff9dde138e8199365908c771b2d7e1ad2f404ac1090d4844f0967c
-
SSDEEP
12288:Qpkek4o3Yo0pMllbLtYQWdwy8xWwuXWgCj7Wl91H5iN:W7BoAMzbZ1+7EvQ1ZiN
Malware Config
Extracted
lokibot
http://merckllc.top/kin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4772 powershell.exe 1264 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
125hGBgWz4WzJqk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 125hGBgWz4WzJqk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
125hGBgWz4WzJqk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 125hGBgWz4WzJqk.exe Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 125hGBgWz4WzJqk.exe Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 125hGBgWz4WzJqk.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
125hGBgWz4WzJqk.exedescription pid process target process PID 1392 set thread context of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
125hGBgWz4WzJqk.exepowershell.exepowershell.exepid process 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 1392 125hGBgWz4WzJqk.exe 4772 powershell.exe 4772 powershell.exe 1264 powershell.exe 1264 powershell.exe 1392 125hGBgWz4WzJqk.exe 4772 powershell.exe 1264 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
125hGBgWz4WzJqk.exepid process 4244 125hGBgWz4WzJqk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
125hGBgWz4WzJqk.exepowershell.exepowershell.exe125hGBgWz4WzJqk.exedescription pid process Token: SeDebugPrivilege 1392 125hGBgWz4WzJqk.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 4244 125hGBgWz4WzJqk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
125hGBgWz4WzJqk.exedescription pid process target process PID 1392 wrote to memory of 4772 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 4772 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 4772 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 1264 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 1264 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 1264 1392 125hGBgWz4WzJqk.exe powershell.exe PID 1392 wrote to memory of 4644 1392 125hGBgWz4WzJqk.exe schtasks.exe PID 1392 wrote to memory of 4644 1392 125hGBgWz4WzJqk.exe schtasks.exe PID 1392 wrote to memory of 4644 1392 125hGBgWz4WzJqk.exe schtasks.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe PID 1392 wrote to memory of 4244 1392 125hGBgWz4WzJqk.exe 125hGBgWz4WzJqk.exe -
outlook_office_path 1 IoCs
Processes:
125hGBgWz4WzJqk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 125hGBgWz4WzJqk.exe -
outlook_win_path 1 IoCs
Processes:
125hGBgWz4WzJqk.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 125hGBgWz4WzJqk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\125hGBgWz4WzJqk.exe"C:\Users\Admin\AppData\Local\Temp\125hGBgWz4WzJqk.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\125hGBgWz4WzJqk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XqVzFQw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XqVzFQw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AD2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\125hGBgWz4WzJqk.exe"C:\Users\Admin\AppData\Local\Temp\125hGBgWz4WzJqk.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3236,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD578fb6ec884a4ae392fc374a217a95bf9
SHA104ed9bbf2c5023953c116838911c79bd4fd06e34
SHA256c9b1e455ec39706db8e3afc45a1364df25eccfb7ed403db878d69332de79fa03
SHA512c14d4beedd5e6bd69ca008966ff08d5c6f534c6a29349bcd64c838e787f8a398fc882ea33960c44dc55dc5ccab545ceb9dc3a20dc5d922c17a1f77dfafdd41c7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_grctajuu.i2j.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp3AD2.tmpFilesize
1KB
MD5bd425dc0f1d8128a0ea74a70845bdf91
SHA1980d92a73dbe607d1a1b9a87dd95010e6bcd0704
SHA256d7abb9054438358aafa2b53f56eb28e935302951f913f5052602fe215ee994bd
SHA512ceba174f5acf6f929dcd12d9fbd1ce96afc28cd0f70ce721f298fb5eeae160ce0e018efca85202ab263f1020331c0e2a03bb9946d0bbc1940e848b483c50b6f2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44acaFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\0f5007522459c86e95ffcc62f32308f1_d2547453-e731-4fdf-8f92-95f955a44acaFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
memory/1264-102-0x0000000007330000-0x000000000733E000-memory.dmpFilesize
56KB
-
memory/1264-37-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1264-98-0x0000000007380000-0x0000000007416000-memory.dmpFilesize
600KB
-
memory/1264-100-0x0000000007300000-0x0000000007311000-memory.dmpFilesize
68KB
-
memory/1264-41-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1264-73-0x0000000074FA0000-0x0000000074FEC000-memory.dmpFilesize
304KB
-
memory/1264-36-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1264-104-0x0000000007440000-0x000000000745A000-memory.dmpFilesize
104KB
-
memory/1264-105-0x0000000007420000-0x0000000007428000-memory.dmpFilesize
32KB
-
memory/1264-112-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1392-16-0x000000007471E000-0x000000007471F000-memory.dmpFilesize
4KB
-
memory/1392-23-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1392-7-0x0000000005530000-0x000000000554A000-memory.dmpFilesize
104KB
-
memory/1392-5-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1392-0-0x000000007471E000-0x000000007471F000-memory.dmpFilesize
4KB
-
memory/1392-3-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/1392-2-0x0000000005840000-0x0000000005DE4000-memory.dmpFilesize
5.6MB
-
memory/1392-8-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/1392-1-0x00000000008A0000-0x0000000000928000-memory.dmpFilesize
544KB
-
memory/1392-4-0x0000000005320000-0x000000000532A000-memory.dmpFilesize
40KB
-
memory/1392-6-0x0000000005780000-0x00000000057FC000-memory.dmpFilesize
496KB
-
memory/1392-9-0x00000000068F0000-0x0000000006952000-memory.dmpFilesize
392KB
-
memory/1392-10-0x0000000008F50000-0x0000000008FEC000-memory.dmpFilesize
624KB
-
memory/1392-51-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4244-38-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4244-99-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4244-119-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4244-39-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4772-15-0x00000000026E0000-0x0000000002716000-memory.dmpFilesize
216KB
-
memory/4772-57-0x0000000007190000-0x00000000071C2000-memory.dmpFilesize
200KB
-
memory/4772-69-0x00000000071D0000-0x0000000007273000-memory.dmpFilesize
652KB
-
memory/4772-90-0x0000000007310000-0x000000000732A000-memory.dmpFilesize
104KB
-
memory/4772-89-0x0000000007950000-0x0000000007FCA000-memory.dmpFilesize
6.5MB
-
memory/4772-91-0x0000000007380000-0x000000000738A000-memory.dmpFilesize
40KB
-
memory/4772-68-0x00000000065A0000-0x00000000065BE000-memory.dmpFilesize
120KB
-
memory/4772-58-0x0000000074FA0000-0x0000000074FEC000-memory.dmpFilesize
304KB
-
memory/4772-53-0x0000000006530000-0x000000000657C000-memory.dmpFilesize
304KB
-
memory/4772-52-0x0000000005FD0000-0x0000000005FEE000-memory.dmpFilesize
120KB
-
memory/4772-25-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4772-103-0x0000000007550000-0x0000000007564000-memory.dmpFilesize
80KB
-
memory/4772-24-0x00000000058F0000-0x0000000005C44000-memory.dmpFilesize
3.3MB
-
memory/4772-22-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4772-20-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/4772-21-0x0000000005880000-0x00000000058E6000-memory.dmpFilesize
408KB
-
memory/4772-19-0x0000000005110000-0x0000000005132000-memory.dmpFilesize
136KB
-
memory/4772-111-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4772-18-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/4772-17-0x0000000005170000-0x0000000005798000-memory.dmpFilesize
6.2MB