Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:25
Static task
static1
Behavioral task
behavioral1
Sample
LMZ0324051754536245.PDF.bin.exe
Resource
win7-20240220-en
General
-
Target
LMZ0324051754536245.PDF.bin.exe
-
Size
524KB
-
MD5
3911e099bed114b7417378e2dbe079d1
-
SHA1
00fea996bbff2b686a0b3e275d536babacefc0af
-
SHA256
e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933
-
SHA512
55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b
-
SSDEEP
12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr
Malware Config
Extracted
lokibot
http://45.61.137.215/index.php/3b1tenbkyj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2652 powershell.exe 2172 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
gJUOIrUR6kc2sEM.exepid process 2288 gJUOIrUR6kc2sEM.exe -
Loads dropped DLL 6 IoCs
Processes:
LMZ0324051754536245.PDF.bin.exeWerFault.exepid process 1992 LMZ0324051754536245.PDF.bin.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LMZ0324051754536245.PDF.bin.exedescription pid process target process PID 1992 set thread context of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 836 2288 WerFault.exe gJUOIrUR6kc2sEM.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exegJUOIrUR6kc2sEM.exepowershell.exepid process 2652 powershell.exe 2288 gJUOIrUR6kc2sEM.exe 2288 gJUOIrUR6kc2sEM.exe 2172 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
LMZ0324051754536245.PDF.bin.exepowershell.exeRegSvcs.exegJUOIrUR6kc2sEM.exepowershell.exedescription pid process Token: SeDebugPrivilege 1992 LMZ0324051754536245.PDF.bin.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2588 RegSvcs.exe Token: SeDebugPrivilege 2288 gJUOIrUR6kc2sEM.exe Token: SeDebugPrivilege 2172 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
LMZ0324051754536245.PDF.bin.exegJUOIrUR6kc2sEM.exedescription pid process target process PID 1992 wrote to memory of 2652 1992 LMZ0324051754536245.PDF.bin.exe powershell.exe PID 1992 wrote to memory of 2652 1992 LMZ0324051754536245.PDF.bin.exe powershell.exe PID 1992 wrote to memory of 2652 1992 LMZ0324051754536245.PDF.bin.exe powershell.exe PID 1992 wrote to memory of 2652 1992 LMZ0324051754536245.PDF.bin.exe powershell.exe PID 1992 wrote to memory of 2288 1992 LMZ0324051754536245.PDF.bin.exe gJUOIrUR6kc2sEM.exe PID 1992 wrote to memory of 2288 1992 LMZ0324051754536245.PDF.bin.exe gJUOIrUR6kc2sEM.exe PID 1992 wrote to memory of 2288 1992 LMZ0324051754536245.PDF.bin.exe gJUOIrUR6kc2sEM.exe PID 1992 wrote to memory of 2288 1992 LMZ0324051754536245.PDF.bin.exe gJUOIrUR6kc2sEM.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 1992 wrote to memory of 2588 1992 LMZ0324051754536245.PDF.bin.exe RegSvcs.exe PID 2288 wrote to memory of 2172 2288 gJUOIrUR6kc2sEM.exe powershell.exe PID 2288 wrote to memory of 2172 2288 gJUOIrUR6kc2sEM.exe powershell.exe PID 2288 wrote to memory of 2172 2288 gJUOIrUR6kc2sEM.exe powershell.exe PID 2288 wrote to memory of 2172 2288 gJUOIrUR6kc2sEM.exe powershell.exe PID 2288 wrote to memory of 836 2288 gJUOIrUR6kc2sEM.exe WerFault.exe PID 2288 wrote to memory of 836 2288 gJUOIrUR6kc2sEM.exe WerFault.exe PID 2288 wrote to memory of 836 2288 gJUOIrUR6kc2sEM.exe WerFault.exe PID 2288 wrote to memory of 836 2288 gJUOIrUR6kc2sEM.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe"C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8203⤵
- Loads dropped DLL
- Program crash
PID:836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991cFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2721934792-624042501-2768869379-1000\0f5007522459c86e95ffcc62f32308f1_dbaf3979-518f-4824-86e4-f33db9fb991cFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD56708d27b4faced8d4b5b5f69ac5ce912
SHA12501e1dfb7eaaf1797af2b02f88c99fbb012d3e2
SHA256ffb5153cc68ec3963285b4581f4b6ea731e7b5f338e1a646d5a48b4672086582
SHA51258b5fe3d13d990998174549fd02d423b35127117b35fe6512c232473416dd591689a482a839af3eda0c305bb8b07315fcc27223d2e2c1e2426880031eed78dc7
-
\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exeFilesize
615KB
MD59fb018d34d80db3b22e721e2768f6bb5
SHA1bba13f32dc03ba024b55a76e92137dec699640cc
SHA2568ef8e3afba42a19e43c2cb6f591ad6ef601791db37b5626f6102e6c4d39667b7
SHA5127f8a28f648b48bbbabdb7c7d78329fe821a11a54b40ed921be460c9875ba02307535cb0847dcf055497978e360f754083b67bc18877c6d6f2cb6b34aa1b3c2a2
-
memory/1992-6-0x0000000004DF0000-0x0000000004E52000-memory.dmpFilesize
392KB
-
memory/1992-5-0x0000000000440000-0x0000000000450000-memory.dmpFilesize
64KB
-
memory/1992-31-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/1992-4-0x00000000005F0000-0x000000000060A000-memory.dmpFilesize
104KB
-
memory/1992-3-0x0000000002230000-0x00000000022AC000-memory.dmpFilesize
496KB
-
memory/1992-0-0x000000007401E000-0x000000007401F000-memory.dmpFilesize
4KB
-
memory/1992-2-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/1992-1-0x0000000000840000-0x00000000008C8000-memory.dmpFilesize
544KB
-
memory/2288-16-0x0000000000A50000-0x0000000000AF0000-memory.dmpFilesize
640KB
-
memory/2288-17-0x0000000002010000-0x00000000020A4000-memory.dmpFilesize
592KB
-
memory/2288-52-0x0000000004450000-0x00000000044C6000-memory.dmpFilesize
472KB
-
memory/2588-24-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-18-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-30-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-26-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-29-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2588-50-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-22-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-20-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2588-70-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB